Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

John W. Linville says:

====================
pull request: wireless 2013-11-21

Please pull this batch of fixes intended for the 3.13 stream!

For the Bluetooth bits, Gustavo says:

"A few fixes for 3.13. There is 3 fixes to the RFCOMM protocol. One
crash fix to L2CAP. A simple fix to a bad behaviour in the SMP
protocol."

On top of that...

Amitkumar Karwar sends a quintet of mwifiex fixes -- two fixes related
to failure handling, two memory leak fixes, and a NULL pointer fix.

Felix Fietkau corrects and earlier rt2x00 HT descriptor handling fix
to address a crash.

Geyslan G. Bem fixes a memory leak in brcmfmac.

Larry Finger address more pointer arithmetic errors in rtlwifi.

Luis R. Rodriguez provides a regulatory fix in the shared ath code.

Sujith Manoharan brings a couple ath9k initialization fixes.

Ujjal Roy offers one more mwifiex fix to avoid invalid memory accesses
when unloading the USB driver.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

4 files changed, 14 insertions, 1 deletions

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 0cef67707838..4af3821df880 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2439,6 +2439,9 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
         int err;
         struct sk_buff_head seg_queue;
 
+        if (!chan->conn)
+                return -ENOTCONN;
+
         /* Connectionless channel */
         if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
                 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 94d06cbfbc18..facd8a79c038 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -694,6 +694,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = 0;
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
         if (*err < 0)
                 goto failed;
@@ -719,6 +720,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
         if (*err == 0 || *err == -EINPROGRESS)
                 return s;
@@ -1983,6 +1985,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
         if (err < 0) {
                 BT_ERR("Bind failed %d", err);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c80766f892c3..3c2d3e4aa2f5 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -738,8 +738,9 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 {
         struct sock *sk = sock->sk;
+        struct sock *l2cap_sk;
+        struct l2cap_conn *conn;
         struct rfcomm_conninfo cinfo;
-        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
         int len, err = 0;
         u32 opt;
 
@@ -782,6 +783,9 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
                         break;
                 }
 
+                l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
+                conn = l2cap_pi(l2cap_sk)->chan->conn;
+
                 memset(&cinfo, 0, sizeof(cinfo));
                 cinfo.hci_handle = conn->hcon->handle;
                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 85a2796cac61..4b07acb8293c 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -742,6 +742,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         BT_DBG("conn %p", conn);
 
+        if (!(conn->hcon->link_mode & HCI_LM_MASTER))
+                return SMP_CMD_NOTSUPP;
+
         hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
 
         if (smp_ltk_encrypt(conn, hcon->pending_sec_level))