Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

John W. Linville says:

====================
Please pull this batch of fixes intende for the 3.13 stream!

For the mac80211 bits, Johannes says:

"For now I have various fixes all over, mostly for issues introduced in
relatively recent patches. There's no real pattern to it. Some of the
issues like go back longer, but still seemed 3.13 material."

And...

"These are just two patches disabling the broken CSA code. Once this
goes into your tree I'll merge it into mac80211-next and revert there
(since we fixed the bugs there)."

For the iwlwifi bits, Emmanuel says:

"I have here a few fixes for BT Coex. One of them is a NULL pointer
dereference. Another one avoids to enable a feature that can make the
firmware unhappy since the firmware isn't ready for it yet. WE also
avoid a WARNING that can be triggered upon association in not-so-bad
cases even if the association succeeded. We add support for new NICs
(not yet on the market) and bump the API so that 3.13 will be able to
work with the new firmware that will be out soon hopefully.
I also have a boundary check from Johannes."

In addition to those...

- Arend van Spriel fixes a brcmfmac problem that could use an
uninitialized variable in an error path.

- Borislav Petkov fixes a Kconfig-based build breakage problem for
brcmsmac.

- Michal Nazarewicz fixes a couple of NULL pointer dereference problems
in ath9k and wcn36xx.

- Sujith Manoharan fixes a couple of ath9k problems related to
incorrect interpretation of EEPROM configuration data.

- Ujjal Roy fixes a memory leak in mwifiex.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 55 insertions, 32 deletions

diff --git a/net/wireless/core.c b/net/wireless/core.c
index aff959e5a1b3..52b865fb7351 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -451,6 +451,15 @@ int wiphy_register(struct wiphy *wiphy)
         int i;
         u16 ifmodes = wiphy->interface_modes;
 
+        /* support for 5/10 MHz is broken due to nl80211 API mess - disable */
+        wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_5_10_MHZ;
+
+        /*
+         * There are major locking problems in nl80211/mac80211 for CSA,
+         * disable for all drivers until this has been reworked.
+         */
+        wiphy->flags &= ~WIPHY_FLAG_HAS_CHANNEL_SWITCH;
+
 #ifdef CONFIG_PM
         if (WARN_ON(wiphy->wowlan &&
                     (wiphy->wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 9d797df56649..89737ee2669a 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -262,7 +262,7 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
 
         /* try to find an IBSS channel if none requested ... */
         if (!wdev->wext.ibss.chandef.chan) {
-                wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                struct ieee80211_channel *new_chan = NULL;
 
                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                         struct ieee80211_supported_band *sband;
@@ -278,18 +278,19 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                                         continue;
                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
                                         continue;
-                                wdev->wext.ibss.chandef.chan = chan;
-                                wdev->wext.ibss.chandef.center_freq1 =
-                                        chan->center_freq;
+                                new_chan = chan;
                                 break;
                         }
 
-                        if (wdev->wext.ibss.chandef.chan)
+                        if (new_chan)
                                 break;
                 }
 
-                if (!wdev->wext.ibss.chandef.chan)
+                if (!new_chan)
                         return -EINVAL;
+
+                cfg80211_chandef_create(&wdev->wext.ibss.chandef, new_chan,
+                                        NL80211_CHAN_NO_HT);
         }
 
         /* don't join -- SSID is not there */
@@ -363,9 +364,8 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                 return err;
 
         if (chan) {
-                wdev->wext.ibss.chandef.chan = chan;
-                wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
-                wdev->wext.ibss.chandef.center_freq1 = freq;
+                cfg80211_chandef_create(&wdev->wext.ibss.chandef, chan,
+                                        NL80211_CHAN_NO_HT);
                 wdev->wext.ibss.channel_fixed = true;
         } else {
                 /* cfg80211_ibss_wext_join will pick one if needed */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index a1eb21073176..138dc3bb8b67 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2687,7 +2687,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                              NL80211_CMD_NEW_KEY);
         if (!hdr)
-                return -ENOBUFS;
+                goto nla_put_failure;
 
         cookie.msg = msg;
         cookie.idx = key_idx;
@@ -5349,6 +5349,10 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                                 err = -EINVAL;
                                 goto out_free;
                         }
+
+                        if (!wiphy->bands[band])
+                                continue;
+
                         err = ieee80211_get_ratemask(wiphy->bands[band],
                                                      nla_data(attr),
                                                      nla_len(attr),
@@ -9633,8 +9637,9 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
                 goto nla_put_failure;
 
-        if (req->flags)
-                nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
+        if (req->flags &&
+            nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
+                goto nla_put_failure;
 
         return 0;
  nla_put_failure:
@@ -11093,6 +11098,8 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
                 struct nlattr *reasons;
 
                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
+                if (!reasons)
+                        goto free_msg;
 
                 if (wakeup->disconnect &&
                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
@@ -11118,16 +11125,18 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
                                 wakeup->pattern_idx))
                         goto free_msg;
 
-                if (wakeup->tcp_match)
-                        nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
+                if (wakeup->tcp_match &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
+                        goto free_msg;
 
-                if (wakeup->tcp_connlost)
-                        nla_put_flag(msg,
-                                     NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
+                if (wakeup->tcp_connlost &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
+                        goto free_msg;
 
-                if (wakeup->tcp_nomoretokens)
-                        nla_put_flag(msg,
-                                NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
+                if (wakeup->tcp_nomoretokens &&
+                    nla_put_flag(msg,
+                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
+                        goto free_msg;
 
                 if (wakeup->packet) {
                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
@@ -11263,24 +11272,29 @@ void cfg80211_ft_event(struct net_device *netdev,
                 return;
 
         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
-        if (!hdr) {
-                nlmsg_free(msg);
-                return;
-        }
+        if (!hdr)
+                goto out;
 
-        nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
-        if (ft_event->ies)
-                nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
-        if (ft_event->ric_ies)
-                nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
-                        ft_event->ric_ies);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
+                goto out;
+
+        if (ft_event->ies &&
+            nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
+                goto out;
+        if (ft_event->ric_ies &&
+            nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
+                    ft_event->ric_ies))
+                goto out;
 
         genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
                                 NL80211_MCGRP_MLME, GFP_KERNEL);
+        return;
+ out:
+        nlmsg_free(msg);
 }
 EXPORT_SYMBOL(cfg80211_ft_event);