Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

7 files changed, 34 insertions, 17 deletions

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b84458dcc226..be84ae33ae36 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -613,7 +613,7 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         if (!test_bit(HCI_RAW, &hdev->flags)) {
                 set_bit(HCI_INIT, &hdev->flags);
                 __hci_request(hdev, hci_reset_req, 0,
-                                        msecs_to_jiffies(250));
+                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
                 clear_bit(HCI_INIT, &hdev->flags);
         }
 
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 5a94eec06caa..5caff4d47596 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -147,8 +147,6 @@ static int read_index_list(struct sock *sk)
 
                 hci_del_off_timer(d);
 
-                set_bit(HCI_MGMT, &d->flags);
-
                 if (test_bit(HCI_SETUP, &d->flags))
                         continue;
 
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 38b618c96de6..4e32e18211f9 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1802,6 +1802,11 @@ static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
                         continue;
                 }
 
+                if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
+                        __rfcomm_dlc_close(d, ECONNREFUSED);
+                        continue;
+                }
+
                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
                         rfcomm_dlc_clear_timer(d);
                         if (d->out) {
@@ -2077,7 +2082,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
                         rfcomm_dlc_clear_timer(d);
                         if (status || encrypt == 0x00) {
-                                __rfcomm_dlc_close(d, ECONNREFUSED);
+                                set_bit(RFCOMM_ENC_DROP, &d->flags);
                                 continue;
                         }
                 }
@@ -2088,7 +2093,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
                                 continue;
                         } else if (d->sec_level == BT_SECURITY_HIGH) {
-                                __rfcomm_dlc_close(d, ECONNREFUSED);
+                                set_bit(RFCOMM_ENC_DROP, &d->flags);
                                 continue;
                         }
                 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index ebd7fb101fbf..d06c65fa5526 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -832,6 +832,12 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (is_multicast_ether_addr(mac))
                 return -EINVAL;
 
+        /* Only TDLS-supporting stations can add TDLS peers */
+        if ((params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
+            !((wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
+              sdata->vif.type == NL80211_IFTYPE_STATION))
+                return -ENOTSUPP;
+
         sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
         if (!sta)
                 return -ENOMEM;
@@ -841,12 +847,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 
         sta_apply_parameters(local, sta, params);
 
-        /* Only TDLS-supporting stations can add TDLS peers */
-        if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
-            !((wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
-              sdata->vif.type == NL80211_IFTYPE_STATION))
-                return -ENOTSUPP;
-
         rate_control_rate_init(sta);
 
         layer2_update = sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 4c3d1f591bec..ea10a51babda 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -389,6 +389,7 @@ struct ieee80211_if_managed {
 
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
+        bool broken_ap; /* AP is broken -- turn off powersave */
         enum ieee80211_smps_mode req_smps, /* requested smps mode */
                                  ap_smps, /* smps mode AP thinks we're in */
                                  driver_smps_mode; /* smps mode request */
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index ba2da11a997b..17258feaab9b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -637,6 +637,9 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
         if (!mgd->powersave)
                 return false;
 
+        if (mgd->broken_ap)
+                return false;
+
         if (!mgd->associated)
                 return false;
 
@@ -1489,10 +1492,21 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
 
         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
-                printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
-                       "set\n", sdata->name, aid);
+                printk(KERN_DEBUG
+                       "%s: invalid AID value 0x%x; bits 15:14 not set\n",
+                       sdata->name, aid);
         aid &= ~(BIT(15) | BIT(14));
 
+        ifmgd->broken_ap = false;
+
+        if (aid == 0 || aid > IEEE80211_MAX_AID) {
+                printk(KERN_DEBUG
+                       "%s: invalid AID value %d (out of range), turn off PS\n",
+                       sdata->name, aid);
+                aid = 0;
+                ifmgd->broken_ap = true;
+        }
+
         pos = mgmt->u.assoc_resp.variable;
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
 
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index 94472eb34d76..6c53b6d1002b 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -1084,14 +1084,13 @@ static void ieee80211_work_work(struct work_struct *work)
                         continue;
                 if (wk->chan != local->tmp_channel)
                         continue;
-                if (ieee80211_work_ct_coexists(wk->chan_type,
-                                               local->tmp_channel_type))
+                if (!ieee80211_work_ct_coexists(wk->chan_type,
+                                                local->tmp_channel_type))
                         continue;
                 remain_off_channel = true;
         }
 
         if (!remain_off_channel && local->tmp_channel) {
-                bool on_oper_chan = ieee80211_cfg_on_oper_channel(local);
                 local->tmp_channel = NULL;
                 /* If tmp_channel wasn't operating channel, then
                  * we need to go back on-channel.
@@ -1101,7 +1100,7 @@ static void ieee80211_work_work(struct work_struct *work)
                  * we still need to do a hardware config.  Currently,
                  * we cannot be here while scanning, however.
                  */
-                if (ieee80211_cfg_on_oper_channel(local) && !on_oper_chan)
+                if (!ieee80211_cfg_on_oper_channel(local))
                         ieee80211_hw_config(local, 0);
 
                 /* At the least, we need to disable offchannel_ps,