wl1271: fixed problem with WPS IEs in probe requests

Inclusion of a WPS IE in probe requests caused a problem
in the driver due to the maximum size of the probe request
template and the max_scan_ie_len values at initialization.

Increased the size of probe request template
to the maximum size allowed by the firmware.
Struct wl12xx_probe_req_template, which was only used
for calculating the max size of the probe request template,
is no longer used and needed.

max_scan_ie_len is used for validating the size of
additional IEs in scan requests.
Initialized the max_scan_ie_len field to the maximum size
of the probe request template minus the ieee80211 header size.

Signed-off-by: Guy Eilam <guy@wizery.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>

3 files changed, 9 insertions, 11 deletions

diff --git a/drivers/net/wireless/wl12xx/init.c b/drivers/net/wireless/wl12xx/init.c
index 0392e37f0d66..785a5304bfc4 100644
--- a/drivers/net/wireless/wl12xx/init.c
+++ b/drivers/net/wireless/wl12xx/init.c
@@ -53,18 +53,16 @@ static int wl1271_init_hwenc_config(struct wl1271 *wl)
 int wl1271_init_templates_config(struct wl1271 *wl)
 {
         int ret, i;
-        size_t size;
 
         /* send empty templates for fw memory reservation */
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_2_4, NULL,
-                                      sizeof(struct wl12xx_probe_req_template),
+                                      WL1271_CMD_TEMPL_MAX_SIZE,
                                       0, WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
 
-        size = sizeof(struct wl12xx_probe_req_template);
         ret = wl1271_cmd_template_set(wl, CMD_TEMPL_CFG_PROBE_REQ_5,
-                                      NULL, size, 0,
+                                      NULL, WL1271_CMD_TEMPL_MAX_SIZE, 0,
                                       WL1271_RATE_AUTOMATIC);
         if (ret < 0)
                 return ret;
diff --git a/drivers/net/wireless/wl12xx/main.c b/drivers/net/wireless/wl12xx/main.c
index f7d7cad730a2..0865585c8a75 100644
--- a/drivers/net/wireless/wl12xx/main.c
+++ b/drivers/net/wireless/wl12xx/main.c
@@ -2666,6 +2666,13 @@ int wl1271_init_ieee80211(struct wl1271 *wl)
         wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC);
         wl->hw->wiphy->max_scan_ssids = 1;
+        /*
+         * Maximum length of elements in scanning probe request templates
+         * should be the maximum length possible for a template, without
+         * the IEEE80211 header of the template
+         */
+        wl->hw->wiphy->max_scan_ie_len = WL1271_CMD_TEMPL_MAX_SIZE -
+                        sizeof(struct ieee80211_header);
         wl->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &wl1271_band_2ghz;
         wl->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &wl1271_band_5ghz;
 
diff --git a/drivers/net/wireless/wl12xx/wl12xx_80211.h b/drivers/net/wireless/wl12xx/wl12xx_80211.h
index 8ee0d3a8fa6e..be21032f4dc1 100644
--- a/drivers/net/wireless/wl12xx/wl12xx_80211.h
+++ b/drivers/net/wireless/wl12xx/wl12xx_80211.h
@@ -134,13 +134,6 @@ struct wl12xx_qos_null_data_template {
         __le16 qos_ctl;
 } __packed;
 
-struct wl12xx_probe_req_template {
-        struct ieee80211_header header;
-        struct wl12xx_ie_ssid ssid;
-        struct wl12xx_ie_rates rates;
-        struct wl12xx_ie_rates ext_rates;
-} __packed;
-
 struct wl12xx_arp_rsp_template {
         struct ieee80211_hdr_3addr hdr;