4 files changed, 35 insertions, 13 deletions

diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 9affe2cd185..b4ddb2f8391 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -48,20 +48,24 @@ static ssize_t ieee80211_if_write(
         ssize_t (*write)(struct ieee80211_sub_if_data *, const char *, int))
 {
         u8 *buf;
-        ssize_t ret = -ENODEV;
+        ssize_t ret;
 
-        buf = kzalloc(count, GFP_KERNEL);
+        buf = kmalloc(count, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
+        ret = -EFAULT;
         if (copy_from_user(buf, userbuf, count))
-                return -EFAULT;
+                goto freebuf;
 
+        ret = -ENODEV;
         rtnl_lock();
         if (sdata->dev->reg_state == NETREG_REGISTERED)
                 ret = (*write)(sdata, buf, count);
         rtnl_unlock();
 
+freebuf:
+        kfree(buf);
         return ret;
 }
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 41812a15eea..be5f723d643 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -177,7 +177,8 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                 sta = sta_info_get(sdata, bssid);
                 if (sta)
                         rate_control_rate_update(local, sband, sta,
-                                                 IEEE80211_RC_HT_CHANGED);
+                                                 IEEE80211_RC_HT_CHANGED,
+                                                 local->oper_channel_type);
                 rcu_read_unlock();
         }
 
@@ -435,10 +436,12 @@ static void ieee80211_enable_ps(struct ieee80211_local *local,
                 if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)
                         ieee80211_send_nullfunc(local, sdata, 1);
 
-                if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
-                        conf->flags |= IEEE80211_CONF_PS;
-                        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-                }
+                if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
+                    (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS))
+                        return;
+
+                conf->flags |= IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         }
 }
 
@@ -557,7 +560,8 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
             (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)))
                 ieee80211_send_nullfunc(local, sdata, 1);
 
-        if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) ||
+        if (!((local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) &&
+              (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK)) ||
             (ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED)) {
                 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
                 local->hw.conf.flags |= IEEE80211_CONF_PS;
@@ -1893,8 +1897,20 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
 
         mutex_lock(&ifmgd->mtx);
         if (ifmgd->associated) {
-                mutex_unlock(&ifmgd->mtx);
-                return -EALREADY;
+                if (!req->prev_bssid ||
+                    memcmp(req->prev_bssid, ifmgd->associated->bssid,
+                           ETH_ALEN)) {
+                        /*
+                         * We are already associated and the request was not a
+                         * reassociation request from the current BSS, so
+                         * reject it.
+                         */
+                        mutex_unlock(&ifmgd->mtx);
+                        return -EALREADY;
+                }
+
+                /* Trying to reassociate - clear previous association state */
+                ieee80211_set_disassoc(sdata);
         }
         mutex_unlock(&ifmgd->mtx);
 
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index b6108bca96d..065a96190e3 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -66,7 +66,8 @@ static inline void rate_control_rate_init(struct sta_info *sta)
 
 static inline void rate_control_rate_update(struct ieee80211_local *local,
                                     struct ieee80211_supported_band *sband,
-                                    struct sta_info *sta, u32 changed)
+                                    struct sta_info *sta, u32 changed,
+                                    enum nl80211_channel_type oper_chan_type)
 {
         struct rate_control_ref *ref = local->rate_ctrl;
         struct ieee80211_sta *ista = &sta->sta;
@@ -74,7 +75,7 @@ static inline void rate_control_rate_update(struct ieee80211_local *local,
 
         if (ref && ref->ops->rate_update)
                 ref->ops->rate_update(ref->priv, sband, ista,
-                                      priv_sta, changed);
+                                      priv_sta, changed, oper_chan_type);
 }
 
 static inline void *rate_control_alloc_sta(struct rate_control_ref *ref,
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 211c475f73c..56422d89435 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -434,6 +434,7 @@ int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
         /* check if STA exists already */
         if (sta_info_get_bss(sdata, sta->sta.addr)) {
                 spin_unlock_irqrestore(&local->sta_lock, flags);
+                mutex_unlock(&local->sta_mtx);
                 rcu_read_lock();
                 err = -EEXIST;
                 goto out_free;