Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

10 files changed, 67 insertions, 27 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index d3a05b9ade7a..bcd158f40bb9 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -393,6 +393,9 @@ int hci_conn_del(struct hci_conn *conn)
 
         hci_dev_put(hdev);
 
+        if (conn->handle == 0)
+                kfree(conn);
+
         return 0;
 }
 
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index c405a954a603..43b4c2deb7cc 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -464,7 +464,8 @@ static void hidp_idle_timeout(unsigned long arg)
 {
         struct hidp_session *session = (struct hidp_session *) arg;
 
-        kthread_stop(session->task);
+        atomic_inc(&session->terminate);
+        wake_up_process(session->task);
 }
 
 static void hidp_set_timer(struct hidp_session *session)
@@ -535,7 +536,8 @@ static void hidp_process_hid_control(struct hidp_session *session,
                 skb_queue_purge(&session->ctrl_transmit);
                 skb_queue_purge(&session->intr_transmit);
 
-                kthread_stop(session->task);
+                atomic_inc(&session->terminate);
+                wake_up_process(current);
         }
 }
 
@@ -706,9 +708,8 @@ static int hidp_session(void *arg)
         add_wait_queue(sk_sleep(intr_sk), &intr_wait);
         session->waiting_for_startup = 0;
         wake_up_interruptible(&session->startup_queue);
-        while (!kthread_should_stop()) {
-                set_current_state(TASK_INTERRUPTIBLE);
-
+        set_current_state(TASK_INTERRUPTIBLE);
+        while (!atomic_read(&session->terminate)) {
                 if (ctrl_sk->sk_state != BT_CONNECTED ||
                                 intr_sk->sk_state != BT_CONNECTED)
                         break;
@@ -726,6 +727,7 @@ static int hidp_session(void *arg)
                 hidp_process_transmit(session);
 
                 schedule();
+                set_current_state(TASK_INTERRUPTIBLE);
         }
         set_current_state(TASK_RUNNING);
         remove_wait_queue(sk_sleep(intr_sk), &intr_wait);
@@ -1060,7 +1062,8 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
 err_add_device:
         hid_destroy_device(session->hid);
         session->hid = NULL;
-        kthread_stop(session->task);
+        atomic_inc(&session->terminate);
+        wake_up_process(session->task);
 
 unlink:
         hidp_del_timer(session);
@@ -1111,7 +1114,8 @@ int hidp_del_connection(struct hidp_conndel_req *req)
                         skb_queue_purge(&session->ctrl_transmit);
                         skb_queue_purge(&session->intr_transmit);
 
-                        kthread_stop(session->task);
+                        atomic_inc(&session->terminate);
+                        wake_up_process(session->task);
                 }
         } else
                 err = -ENOENT;
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index 19e95004b286..af1bcc823f26 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -142,6 +142,7 @@ struct hidp_session {
         uint ctrl_mtu;
         uint intr_mtu;
 
+        atomic_t terminate;
         struct task_struct *task;
 
         unsigned char keys[8];
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 56fdd9162da9..ebff14c69078 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2323,7 +2323,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
         sk = chan->sk;
 
-        if (sk->sk_state != BT_CONFIG) {
+        if ((bt_sk(sk)->defer_setup && sk->sk_state != BT_CONNECT2) ||
+                 (!bt_sk(sk)->defer_setup && sk->sk_state != BT_CONFIG)) {
                 struct l2cap_cmd_rej rej;
 
                 rej.reason = cpu_to_le16(0x0002);
@@ -2334,7 +2335,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
         /* Reject if config buffer is too small. */
         len = cmd_len - sizeof(*req);
-        if (chan->conf_len + len > sizeof(chan->conf_req)) {
+        if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
                                 l2cap_build_conf_rsp(chan, rsp,
                                         L2CAP_CONF_REJECT, flags), rsp);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 58ffa7d069c7..669d2e32efb6 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -877,7 +877,8 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                 local->sched_scan_ies.ie[i] = kzalloc(2 +
                                                       IEEE80211_MAX_SSID_LEN +
-                                                      local->scan_ies_len,
+                                                      local->scan_ies_len +
+                                                      req->ie_len,
                                                       GFP_KERNEL);
                 if (!local->sched_scan_ies.ie[i]) {
                         ret = -ENOMEM;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index d91c1a26630d..8f6a302d2ac3 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -86,6 +86,11 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         struct sk_buff *skb = rx->skb;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        int queue = rx->queue;
+
+        /* otherwise, TKIP is vulnerable to TID 0 vs. non-QoS replays */
+        if (rx->queue == NUM_RX_DATA_QUEUES - 1)
+                queue = 0;
 
         /*
          * it makes no sense to check for MIC errors on anything other
@@ -148,8 +153,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 
 update_iv:
         /* update IV in key information to be able to detect replays */
-        rx->key->u.tkip.rx[rx->queue].iv32 = rx->tkip_iv32;
-        rx->key->u.tkip.rx[rx->queue].iv16 = rx->tkip_iv16;
+        rx->key->u.tkip.rx[queue].iv32 = rx->tkip_iv32;
+        rx->key->u.tkip.rx[queue].iv16 = rx->tkip_iv16;
 
         return RX_CONTINUE;
 
@@ -241,6 +246,11 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
         struct ieee80211_key *key = rx->key;
         struct sk_buff *skb = rx->skb;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        int queue = rx->queue;
+
+        /* otherwise, TKIP is vulnerable to TID 0 vs. non-QoS replays */
+        if (rx->queue == NUM_RX_DATA_QUEUES - 1)
+                queue = 0;
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
@@ -261,7 +271,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
         res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
                                           key, skb->data + hdrlen,
                                           skb->len - hdrlen, rx->sta->sta.addr,
-                                          hdr->addr1, hwaccel, rx->queue,
+                                          hdr->addr1, hwaccel, queue,
                                           &rx->tkip_iv32,
                                           &rx->tkip_iv16);
         if (res != TKIP_DECRYPT_OK)
diff --git a/net/wireless/core.c b/net/wireless/core.c
index c22ef3492ee6..880dbe2e6f94 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -366,6 +366,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
 
         mutex_init(&rdev->mtx);
         mutex_init(&rdev->devlist_mtx);
+        mutex_init(&rdev->sched_scan_mtx);
         INIT_LIST_HEAD(&rdev->netdev_list);
         spin_lock_init(&rdev->bss_lock);
         INIT_LIST_HEAD(&rdev->bss_list);
@@ -701,6 +702,7 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
         rfkill_destroy(rdev->rfkill);
         mutex_destroy(&rdev->mtx);
         mutex_destroy(&rdev->devlist_mtx);
+        mutex_destroy(&rdev->sched_scan_mtx);
         list_for_each_entry_safe(scan, tmp, &rdev->bss_list, list)
                 cfg80211_put_bss(&scan->pub);
         cfg80211_rdev_free_wowlan(rdev);
@@ -737,12 +739,16 @@ static void wdev_cleanup_work(struct work_struct *work)
                 ___cfg80211_scan_done(rdev, true);
         }
 
+        cfg80211_unlock_rdev(rdev);
+
+        mutex_lock(&rdev->sched_scan_mtx);
+
         if (WARN_ON(rdev->sched_scan_req &&
                     rdev->sched_scan_req->dev == wdev->netdev)) {
                 __cfg80211_stop_sched_scan(rdev, false);
         }
 
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 
         mutex_lock(&rdev->devlist_mtx);
         rdev->opencount--;
@@ -830,9 +836,9 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         break;
                 case NL80211_IFTYPE_P2P_CLIENT:
                 case NL80211_IFTYPE_STATION:
-                        cfg80211_lock_rdev(rdev);
+                        mutex_lock(&rdev->sched_scan_mtx);
                         __cfg80211_stop_sched_scan(rdev, false);
-                        cfg80211_unlock_rdev(rdev);
+                        mutex_unlock(&rdev->sched_scan_mtx);
 
                         wdev_lock(wdev);
 #ifdef CONFIG_CFG80211_WEXT
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 3dce1f167eba..a570ff9214ec 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -65,6 +65,8 @@ struct cfg80211_registered_device {
         struct work_struct scan_done_wk;
         struct work_struct sched_scan_results_wk;
 
+        struct mutex sched_scan_mtx;
+
 #ifdef CONFIG_NL80211_TESTMODE
         struct genl_info *testmode_info;
 #endif
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index f07602d7bf68..cea338150d05 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3461,9 +3461,6 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
 
-        if (rdev->sched_scan_req)
-                return -EINPROGRESS;
-
         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
                 return -EINVAL;
 
@@ -3502,12 +3499,21 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
         if (ie_len > wiphy->max_scan_ie_len)
                 return -EINVAL;
 
+        mutex_lock(&rdev->sched_scan_mtx);
+
+        if (rdev->sched_scan_req) {
+                err = -EINPROGRESS;
+                goto out;
+        }
+
         request = kzalloc(sizeof(*request)
                         + sizeof(*request->ssids) * n_ssids
                         + sizeof(*request->channels) * n_channels
                         + ie_len, GFP_KERNEL);
-        if (!request)
-                return -ENOMEM;
+        if (!request) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         if (n_ssids)
                 request->ssids = (void *)&request->channels[n_channels];
@@ -3605,6 +3611,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
 out_free:
         kfree(request);
 out:
+        mutex_unlock(&rdev->sched_scan_mtx);
         return err;
 }
 
@@ -3612,12 +3619,17 @@ static int nl80211_stop_sched_scan(struct sk_buff *skb,
                                    struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        int err;
 
         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
             !rdev->ops->sched_scan_stop)
                 return -EOPNOTSUPP;
 
-        return __cfg80211_stop_sched_scan(rdev, false);
+        mutex_lock(&rdev->sched_scan_mtx);
+        err = __cfg80211_stop_sched_scan(rdev, false);
+        mutex_unlock(&rdev->sched_scan_mtx);
+
+        return err;
 }
 
 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 7a6c67667d70..ae0c2256ba3b 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -100,14 +100,14 @@ void __cfg80211_sched_scan_results(struct work_struct *wk)
         rdev = container_of(wk, struct cfg80211_registered_device,
                             sched_scan_results_wk);
 
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
 
         /* we don't have sched_scan_req anymore if the scan is stopping */
         if (rdev->sched_scan_req)
                 nl80211_send_sched_scan_results(rdev,
                                                 rdev->sched_scan_req->dev);
 
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 }
 
 void cfg80211_sched_scan_results(struct wiphy *wiphy)
@@ -123,9 +123,9 @@ void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
         __cfg80211_stop_sched_scan(rdev, true);
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 }
 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
 
@@ -135,7 +135,7 @@ int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
         int err;
         struct net_device *dev;
 
-        ASSERT_RDEV_LOCK(rdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         if (!rdev->sched_scan_req)
                 return 0;