Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
 "Let's begin the holiday weekend with some networking fixes:

   1) Whoops need to restrict cfg80211 wiphy names even more to 64
      bytes. From Eric Biggers.

   2) Fix flags being ignored when using kernel_connect() with SCTP,
      from Xin Long.

   3) Use after free in DCCP, from Alexey Kodanev.

   4) Need to check rhltable_init() return value in ipmr code, from Eric
      Dumazet.

   5) XDP handling fixes in virtio_net from Jason Wang.

   6) Missing RTA_TABLE in rtm_ipv4_policy[], from Roopa Prabhu.

   7) Need to use IRQ disabling spinlocks in mlx4_qp_lookup(), from Jack
      Morgenstein.

   8) Prevent out-of-bounds speculation using indexes in BPF, from
      Daniel Borkmann.

   9) Fix regression added by AF_PACKET link layer cure, from Willem de
      Bruijn.

  10) Correct ENIC dma mask, from Govindarajulu Varadarajan.

  11) Missing config options for PMTU tests, from Stefano Brivio"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (48 commits)
  ibmvnic: Fix partial success login retries
  selftests/net: Add missing config options for PMTU tests
  mlx4_core: allocate ICM memory in page size chunks
  enic: set DMA mask to 47 bit
  ppp: remove the PPPIOCDETACH ioctl
  ipv4: remove warning in ip_recv_error
  net : sched: cls_api: deal with egdev path only if needed
  vhost: synchronize IOTLB message with dev cleanup
  packet: fix reserve calculation
  net/mlx5: IPSec, Fix a race between concurrent sandbox QP commands
  net/mlx5e: When RXFCS is set, add FCS data into checksum calculation
  bpf: properly enforce index mask to prevent out-of-bounds speculation
  net/mlx4: Fix irq-unsafe spinlock usage
  net: phy: broadcom: Fix bcm_write_exp()
  net: phy: broadcom: Fix auxiliary control register reads
  net: ipv4: add missing RTA_TABLE to rtm_ipv4_policy
  net/mlx4: fix spelling mistake: "Inrerface" -> "Interface" and rephrase message
  ibmvnic: Only do H_EOI for mobility events
  tuntap: correctly set SOCKWQ_ASYNC_NOSPACE
  virtio-net: fix leaking page for gso packet during mergeable XDP
  ...

14 files changed, 121 insertions, 48 deletions

diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index a11d3d89f012..a35f597e8c8b 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -1536,7 +1536,7 @@ out:
 
         if (!ret && primary_if)
                 *primary_if = hard_iface;
-        else
+        else if (hard_iface)
                 batadv_hardif_put(hard_iface);
 
         return ret;
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 0225616d5771..3986551397ca 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -862,7 +862,7 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node,
         struct batadv_orig_node_vlan *vlan;
         u8 *tt_change_ptr;
 
-        rcu_read_lock();
+        spin_lock_bh(&orig_node->vlan_list_lock);
         hlist_for_each_entry_rcu(vlan, &orig_node->vlan_list, list) {
                 num_vlan++;
                 num_entries += atomic_read(&vlan->tt.num_entries);
@@ -900,7 +900,7 @@ batadv_tt_prepare_tvlv_global_data(struct batadv_orig_node *orig_node,
         *tt_change = (struct batadv_tvlv_tt_change *)tt_change_ptr;
 
 out:
-        rcu_read_unlock();
+        spin_unlock_bh(&orig_node->vlan_list_lock);
         return tvlv_len;
 }
 
@@ -931,15 +931,20 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv,
         struct batadv_tvlv_tt_vlan_data *tt_vlan;
         struct batadv_softif_vlan *vlan;
         u16 num_vlan = 0;
-        u16 num_entries = 0;
+        u16 vlan_entries = 0;
+        u16 total_entries = 0;
         u16 tvlv_len;
         u8 *tt_change_ptr;
         int change_offset;
 
-        rcu_read_lock();
+        spin_lock_bh(&bat_priv->softif_vlan_list_lock);
         hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list) {
+                vlan_entries = atomic_read(&vlan->tt.num_entries);
+                if (vlan_entries < 1)
+                        continue;
+
                 num_vlan++;
-                num_entries += atomic_read(&vlan->tt.num_entries);
+                total_entries += vlan_entries;
         }
 
         change_offset = sizeof(**tt_data);
@@ -947,7 +952,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv,
 
         /* if tt_len is negative, allocate the space needed by the full table */
         if (*tt_len < 0)
-                *tt_len = batadv_tt_len(num_entries);
+                *tt_len = batadv_tt_len(total_entries);
 
         tvlv_len = *tt_len;
         tvlv_len += change_offset;
@@ -964,6 +969,10 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv,
 
         tt_vlan = (struct batadv_tvlv_tt_vlan_data *)(*tt_data + 1);
         hlist_for_each_entry_rcu(vlan, &bat_priv->softif_vlan_list, list) {
+                vlan_entries = atomic_read(&vlan->tt.num_entries);
+                if (vlan_entries < 1)
+                        continue;
+
                 tt_vlan->vid = htons(vlan->vid);
                 tt_vlan->crc = htonl(vlan->tt.crc);
 
@@ -974,7 +983,7 @@ batadv_tt_prepare_tvlv_local_data(struct batadv_priv *bat_priv,
         *tt_change = (struct batadv_tvlv_tt_change *)tt_change_ptr;
 
 out:
-        rcu_read_unlock();
+        spin_unlock_bh(&bat_priv->softif_vlan_list_lock);
         return tvlv_len;
 }
 
@@ -1538,6 +1547,8 @@ batadv_tt_global_orig_entry_find(const struct batadv_tt_global_entry *entry,
  *  handled by a given originator
  * @entry: the TT global entry to check
  * @orig_node: the originator to search in the list
+ * @flags: a pointer to store TT flags for the given @entry received
+ *  from @orig_node
  *
  * find out if an orig_node is already in the list of a tt_global_entry.
  *
@@ -1545,7 +1556,8 @@ batadv_tt_global_orig_entry_find(const struct batadv_tt_global_entry *entry,
  */
 static bool
 batadv_tt_global_entry_has_orig(const struct batadv_tt_global_entry *entry,
-                                const struct batadv_orig_node *orig_node)
+                                const struct batadv_orig_node *orig_node,
+                                u8 *flags)
 {
         struct batadv_tt_orig_list_entry *orig_entry;
         bool found = false;
@@ -1553,6 +1565,10 @@ batadv_tt_global_entry_has_orig(const struct batadv_tt_global_entry *entry,
         orig_entry = batadv_tt_global_orig_entry_find(entry, orig_node);
         if (orig_entry) {
                 found = true;
+
+                if (flags)
+                        *flags = orig_entry->flags;
+
                 batadv_tt_orig_list_entry_put(orig_entry);
         }
 
@@ -1731,7 +1747,7 @@ static bool batadv_tt_global_add(struct batadv_priv *bat_priv,
                         if (!(common->flags & BATADV_TT_CLIENT_TEMP))
                                 goto out;
                         if (batadv_tt_global_entry_has_orig(tt_global_entry,
-                                                            orig_node))
+                                                            orig_node, NULL))
                                 goto out_remove;
                         batadv_tt_global_del_orig_list(tt_global_entry);
                         goto add_orig_entry;
@@ -2880,23 +2896,46 @@ unlock:
 }
 
 /**
- * batadv_tt_local_valid() - verify that given tt entry is a valid one
+ * batadv_tt_local_valid() - verify local tt entry and get flags
  * @entry_ptr: to be checked local tt entry
  * @data_ptr: not used but definition required to satisfy the callback prototype
+ * @flags: a pointer to store TT flags for this client to
+ *
+ * Checks the validity of the given local TT entry. If it is, then the provided
+ * flags pointer is updated.
  *
  * Return: true if the entry is a valid, false otherwise.
  */
-static bool batadv_tt_local_valid(const void *entry_ptr, const void *data_ptr)
+static bool batadv_tt_local_valid(const void *entry_ptr,
+                                  const void *data_ptr,
+                                  u8 *flags)
 {
         const struct batadv_tt_common_entry *tt_common_entry = entry_ptr;
 
         if (tt_common_entry->flags & BATADV_TT_CLIENT_NEW)
                 return false;
+
+        if (flags)
+                *flags = tt_common_entry->flags;
+
         return true;
 }
 
+/**
+ * batadv_tt_global_valid() - verify global tt entry and get flags
+ * @entry_ptr: to be checked global tt entry
+ * @data_ptr: an orig_node object (may be NULL)
+ * @flags: a pointer to store TT flags for this client to
+ *
+ * Checks the validity of the given global TT entry. If it is, then the provided
+ * flags pointer is updated either with the common (summed) TT flags if data_ptr
+ * is NULL or the specific, per originator TT flags otherwise.
+ *
+ * Return: true if the entry is a valid, false otherwise.
+ */
 static bool batadv_tt_global_valid(const void *entry_ptr,
-                                   const void *data_ptr)
+                                   const void *data_ptr,
+                                   u8 *flags)
 {
         const struct batadv_tt_common_entry *tt_common_entry = entry_ptr;
         const struct batadv_tt_global_entry *tt_global_entry;
@@ -2910,7 +2949,8 @@ static bool batadv_tt_global_valid(const void *entry_ptr,
                                        struct batadv_tt_global_entry,
                                        common);
 
-        return batadv_tt_global_entry_has_orig(tt_global_entry, orig_node);
+        return batadv_tt_global_entry_has_orig(tt_global_entry, orig_node,
+                                               flags);
 }
 
 /**
@@ -2920,25 +2960,34 @@ static bool batadv_tt_global_valid(const void *entry_ptr,
  * @hash: hash table containing the tt entries
  * @tt_len: expected tvlv tt data buffer length in number of bytes
  * @tvlv_buff: pointer to the buffer to fill with the TT data
- * @valid_cb: function to filter tt change entries
+ * @valid_cb: function to filter tt change entries and to return TT flags
  * @cb_data: data passed to the filter function as argument
+ *
+ * Fills the tvlv buff with the tt entries from the specified hash. If valid_cb
+ * is not provided then this becomes a no-op.
  */
 static void batadv_tt_tvlv_generate(struct batadv_priv *bat_priv,
                                     struct batadv_hashtable *hash,
                                     void *tvlv_buff, u16 tt_len,
                                     bool (*valid_cb)(const void *,
-                                                     const void *),
+                                                     const void *,
+                                                     u8 *flags),
                                     void *cb_data)
 {
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tvlv_tt_change *tt_change;
         struct hlist_head *head;
         u16 tt_tot, tt_num_entries = 0;
+        u8 flags;
+        bool ret;
         u32 i;
 
         tt_tot = batadv_tt_entries(tt_len);
         tt_change = (struct batadv_tvlv_tt_change *)tvlv_buff;
 
+        if (!valid_cb)
+                return;
+
         rcu_read_lock();
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
@@ -2948,11 +2997,12 @@ static void batadv_tt_tvlv_generate(struct batadv_priv *bat_priv,
                         if (tt_tot == tt_num_entries)
                                 break;
 
-                        if ((valid_cb) && (!valid_cb(tt_common_entry, cb_data)))
+                        ret = valid_cb(tt_common_entry, cb_data, &flags);
+                        if (!ret)
                                 continue;
 
                         ether_addr_copy(tt_change->addr, tt_common_entry->addr);
-                        tt_change->flags = tt_common_entry->flags;
+                        tt_change->flags = flags;
                         tt_change->vid = htons(tt_common_entry->vid);
                         memset(tt_change->reserved, 0,
                                sizeof(tt_change->reserved));
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 84cd4e3fd01b..0d56e36a6db7 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -283,9 +283,7 @@ int dccp_disconnect(struct sock *sk, int flags)
 
         dccp_clear_xmit_timers(sk);
         ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
-        ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
         dp->dccps_hc_rx_ccid = NULL;
-        dp->dccps_hc_tx_ccid = NULL;
 
         __skb_queue_purge(&sk->sk_receive_queue);
         __skb_queue_purge(&sk->sk_write_queue);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 4d622112bf95..e66172aaf241 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -649,6 +649,7 @@ const struct nla_policy rtm_ipv4_policy[RTA_MAX + 1] = {
         [RTA_ENCAP]             = { .type = NLA_NESTED },
         [RTA_UID]               = { .type = NLA_U32 },
         [RTA_MARK]              = { .type = NLA_U32 },
+        [RTA_TABLE]             = { .type = NLA_U32 },
 };
 
 static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 5ad2d8ed3a3f..57bbb060faaf 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -505,8 +505,6 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
         int err;
         int copied;
 
-        WARN_ON_ONCE(sk->sk_family == AF_INET6);
-
         err = -EAGAIN;
         skb = sock_dequeue_err_skb(sk);
         if (!skb)
diff --git a/net/ipv4/ipmr_base.c b/net/ipv4/ipmr_base.c
index 4fe97723b53f..30221701614c 100644
--- a/net/ipv4/ipmr_base.c
+++ b/net/ipv4/ipmr_base.c
@@ -43,7 +43,10 @@ mr_table_alloc(struct net *net, u32 id,
         write_pnet(&mrt->net, net);
 
         mrt->ops = *ops;
-        rhltable_init(&mrt->mfc_hash, mrt->ops.rht_params);
+        if (rhltable_init(&mrt->mfc_hash, mrt->ops.rht_params)) {
+                kfree(mrt);
+                return NULL;
+        }
         INIT_LIST_HEAD(&mrt->mfc_cache_list);
         INIT_LIST_HEAD(&mrt->mfc_unres_queue);
 
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 0f6c9ca59062..5b5b0f95ffd1 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -401,7 +401,7 @@ u32 mesh_plink_deactivate(struct sta_info *sta)
 
 static void mesh_sta_info_init(struct ieee80211_sub_if_data *sdata,
                                struct sta_info *sta,
-                               struct ieee802_11_elems *elems, bool insert)
+                               struct ieee802_11_elems *elems)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
@@ -447,7 +447,7 @@ static void mesh_sta_info_init(struct ieee80211_sub_if_data *sdata,
                 sta->sta.bandwidth = IEEE80211_STA_RX_BW_20;
         }
 
-        if (insert)
+        if (!test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
                 rate_control_rate_init(sta);
         else
                 rate_control_rate_update(local, sband, sta, changed);
@@ -551,7 +551,7 @@ mesh_sta_info_get(struct ieee80211_sub_if_data *sdata,
         rcu_read_lock();
         sta = sta_info_get(sdata, addr);
         if (sta) {
-                mesh_sta_info_init(sdata, sta, elems, false);
+                mesh_sta_info_init(sdata, sta, elems);
         } else {
                 rcu_read_unlock();
                 /* can't run atomic */
@@ -561,7 +561,7 @@ mesh_sta_info_get(struct ieee80211_sub_if_data *sdata,
                         return NULL;
                 }
 
-                mesh_sta_info_init(sdata, sta, elems, true);
+                mesh_sta_info_init(sdata, sta, elems);
 
                 if (sta_info_insert_rcu(sta))
                         return NULL;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index e9422fe45179..acb7b86574cd 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2911,7 +2911,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                 if (unlikely(offset < 0))
                         goto out_free;
         } else if (reserve) {
-                skb_push(skb, reserve);
+                skb_reserve(skb, -reserve);
         }
 
         /* Returns -EFAULT on error */
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 963e4bf0aab8..a57e112d9b3e 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -1588,7 +1588,7 @@ int tc_setup_cb_call(struct tcf_block *block, struct tcf_exts *exts,
                 return ret;
         ok_count = ret;
 
-        if (!exts)
+        if (!exts || ok_count)
                 return ok_count;
         ret = tc_exts_setup_cb_egdev_call(exts, type, type_data, err_stop);
         if (ret < 0)
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 42247110d842..0cd2e764f47f 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -1006,7 +1006,7 @@ static const struct proto_ops inet6_seqpacket_ops = {
         .owner             = THIS_MODULE,
         .release           = inet6_release,
         .bind              = inet6_bind,
-        .connect           = inet_dgram_connect,
+        .connect           = sctp_inet_connect,
         .socketpair        = sock_no_socketpair,
         .accept            = inet_accept,
         .getname           = sctp_getname,
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index d685f8456762..6bf0a9971888 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1012,7 +1012,7 @@ static const struct proto_ops inet_seqpacket_ops = {
         .owner             = THIS_MODULE,
         .release           = inet_release,      /* Needs to be wrapped... */
         .bind              = inet_bind,
-        .connect           = inet_dgram_connect,
+        .connect           = sctp_inet_connect,
         .socketpair        = sock_no_socketpair,
         .accept            = inet_accept,
         .getname           = inet_getname,      /* Semantics are different.  */
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 80835ac26d2c..ae7e7c606f72 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1086,7 +1086,7 @@ out:
  */
 static int __sctp_connect(struct sock *sk,
                           struct sockaddr *kaddrs,
-                          int addrs_size,
+                          int addrs_size, int flags,
                           sctp_assoc_t *assoc_id)
 {
         struct net *net = sock_net(sk);
@@ -1104,7 +1104,6 @@ static int __sctp_connect(struct sock *sk,
         union sctp_addr *sa_addr = NULL;
         void *addr_buf;
         unsigned short port;
-        unsigned int f_flags = 0;
 
         sp = sctp_sk(sk);
         ep = sp->ep;
@@ -1254,13 +1253,7 @@ static int __sctp_connect(struct sock *sk,
         sp->pf->to_sk_daddr(sa_addr, sk);
         sk->sk_err = 0;
 
-        /* in-kernel sockets don't generally have a file allocated to them
-         * if all they do is call sock_create_kern().
-         */
-        if (sk->sk_socket->file)
-                f_flags = sk->sk_socket->file->f_flags;
-
-        timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK);
+        timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
 
         if (assoc_id)
                 *assoc_id = asoc->assoc_id;
@@ -1348,7 +1341,7 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
                                       sctp_assoc_t *assoc_id)
 {
         struct sockaddr *kaddrs;
-        int err = 0;
+        int err = 0, flags = 0;
 
         pr_debug("%s: sk:%p addrs:%p addrs_size:%d\n",
                  __func__, sk, addrs, addrs_size);
@@ -1367,7 +1360,13 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
         if (err)
                 goto out_free;
 
-        err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id);
+        /* in-kernel sockets don't generally have a file allocated to them
+         * if all they do is call sock_create_kern().
+         */
+        if (sk->sk_socket->file)
+                flags = sk->sk_socket->file->f_flags;
+
+        err = __sctp_connect(sk, kaddrs, addrs_size, flags, assoc_id);
 
 out_free:
         kvfree(kaddrs);
@@ -4397,16 +4396,26 @@ out_nounlock:
  * len: the size of the address.
  */
 static int sctp_connect(struct sock *sk, struct sockaddr *addr,
-                        int addr_len)
+                        int addr_len, int flags)
 {
-        int err = 0;
+        struct inet_sock *inet = inet_sk(sk);
         struct sctp_af *af;
+        int err = 0;
 
         lock_sock(sk);
 
         pr_debug("%s: sk:%p, sockaddr:%p, addr_len:%d\n", __func__, sk,
                  addr, addr_len);
 
+        /* We may need to bind the socket. */
+        if (!inet->inet_num) {
+                if (sk->sk_prot->get_port(sk, 0)) {
+                        release_sock(sk);
+                        return -EAGAIN;
+                }
+                inet->inet_sport = htons(inet->inet_num);
+        }
+
         /* Validate addr_len before calling common connect/connectx routine. */
         af = sctp_get_af_specific(addr->sa_family);
         if (!af || addr_len < af->sockaddr_len) {
@@ -4415,13 +4424,25 @@ static int sctp_connect(struct sock *sk, struct sockaddr *addr,
                 /* Pass correct addr len to common routine (so it knows there
                  * is only one address being passed.
                  */
-                err = __sctp_connect(sk, addr, af->sockaddr_len, NULL);
+                err = __sctp_connect(sk, addr, af->sockaddr_len, flags, NULL);
         }
 
         release_sock(sk);
         return err;
 }
 
+int sctp_inet_connect(struct socket *sock, struct sockaddr *uaddr,
+                      int addr_len, int flags)
+{
+        if (addr_len < sizeof(uaddr->sa_family))
+                return -EINVAL;
+
+        if (uaddr->sa_family == AF_UNSPEC)
+                return -EOPNOTSUPP;
+
+        return sctp_connect(sock->sk, uaddr, addr_len, flags);
+}
+
 /* FIXME: Write comments. */
 static int sctp_disconnect(struct sock *sk, int flags)
 {
@@ -8724,7 +8745,6 @@ struct proto sctp_prot = {
         .name        =  "SCTP",
         .owner       =  THIS_MODULE,
         .close       =  sctp_close,
-        .connect     =  sctp_connect,
         .disconnect  =  sctp_disconnect,
         .accept      =  sctp_accept,
         .ioctl       =  sctp_ioctl,
@@ -8767,7 +8787,6 @@ struct proto sctpv6_prot = {
         .name           = "SCTPv6",
         .owner          = THIS_MODULE,
         .close          = sctp_close,
-        .connect        = sctp_connect,
         .disconnect     = sctp_disconnect,
         .accept         = sctp_accept,
         .ioctl          = sctp_ioctl,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index a052693c2e85..7c5135a92d76 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -15555,7 +15555,8 @@ void cfg80211_ft_event(struct net_device *netdev,
         if (!ft_event->target_ap)
                 return;
 
-        msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL);
+        msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
+                        GFP_KERNEL);
         if (!msg)
                 return;
 
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index ac3e12c32aa3..5fcec5c94eb7 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -916,6 +916,9 @@ int reg_query_regdb_wmm(char *alpha2, int freq, u32 *dbptr,
         const struct fwdb_header *hdr = regdb;
         const struct fwdb_country *country;
 
+        if (!regdb)
+                return -ENODATA;
+
         if (IS_ERR(regdb))
                 return PTR_ERR(regdb);