Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

Conflicts:
	drivers/net/wireless/brcm80211/Kconfig
	net/mac80211/util.c

15 files changed, 99 insertions, 59 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 754069cbb756..f80e8c4c6bcd 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1394,7 +1394,7 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                         changed |=
                               ieee80211_mps_set_sta_local_pm(sta,
                                                              params->local_pm);
-                ieee80211_bss_info_change_notify(sdata, changed);
+                ieee80211_mbss_info_change_notify(sdata, changed);
 #endif
         }
 
@@ -2514,8 +2514,7 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
-            sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EOPNOTSUPP;
 
         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
@@ -3156,9 +3155,17 @@ static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                     params->chandef.chan->band)
                         return -EINVAL;
 
+                ifmsh->chsw_init = true;
+                if (!ifmsh->pre_value)
+                        ifmsh->pre_value = 1;
+                else
+                        ifmsh->pre_value++;
+
                 err = ieee80211_mesh_csa_beacon(sdata, params, true);
-                if (err < 0)
+                if (err < 0) {
+                        ifmsh->chsw_init = false;
                         return err;
+                }
                 break;
 #endif
         default:
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 0f1fb5db4bdb..2eda7b13124a 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -823,6 +823,10 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         if (err)
                 return false;
 
+        /* channel switch is not supported, disconnect */
+        if (!(sdata->local->hw.wiphy->flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
+                goto disconnect;
+
         params.count = csa_ie.count;
         params.chandef = csa_ie.chandef;
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 32bae218d6e5..ed5bf8b4b5c2 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1256,6 +1256,7 @@ struct ieee80211_csa_ie {
         u8 mode;
         u8 count;
         u8 ttl;
+        u16 pre_value;
 };
 
 /* Parsed Information Elements */
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index d226751ba63a..7aa9f9dea9df 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1327,7 +1327,6 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                 sdata->vif.bss_conf.bssid = NULL;
                 break;
         case NL80211_IFTYPE_AP_VLAN:
-                break;
         case NL80211_IFTYPE_P2P_DEVICE:
                 sdata->vif.bss_conf.bssid = sdata->vif.addr;
                 break;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 8af75f0eed6d..fa34cd2344b9 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -995,6 +995,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
                             result);
 
+        local->hw.conf.flags = IEEE80211_CONF_IDLE;
+
         ieee80211_led_init(local);
 
         rtnl_lock();
@@ -1102,6 +1104,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         cancel_work_sync(&local->restart_work);
         cancel_work_sync(&local->reconfig_filter);
+        flush_work(&local->sched_scan_stopped_work);
 
         ieee80211_clear_tx_pending(local);
         rate_control_deinitialize(local);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 330d1f71c0c9..89df62b2b689 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -940,14 +940,19 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
                  params.chandef.chan->center_freq);
 
         params.block_tx = csa_ie.mode & WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT;
-        if (beacon)
+        if (beacon) {
                 ifmsh->chsw_ttl = csa_ie.ttl - 1;
-        else
-                ifmsh->chsw_ttl = 0;
+                if (ifmsh->pre_value >= csa_ie.pre_value)
+                        return false;
+                ifmsh->pre_value = csa_ie.pre_value;
+        }
 
-        if (ifmsh->chsw_ttl > 0)
+        if (ifmsh->chsw_ttl < ifmsh->mshcfg.dot11MeshTTL) {
                 if (ieee80211_mesh_csa_beacon(sdata, &params, false) < 0)
                         return false;
+        } else {
+                return false;
+        }
 
         sdata->csa_radar_required = params.radar_required;
 
@@ -1160,7 +1165,6 @@ static int mesh_fwd_csa_frame(struct ieee80211_sub_if_data *sdata,
         offset_ttl = (len < 42) ? 7 : 10;
         *(pos + offset_ttl) -= 1;
         *(pos + offset_ttl + 1) &= ~WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
-        sdata->u.mesh.chsw_ttl = *(pos + offset_ttl);
 
         memcpy(mgmt_fwd, mgmt, len);
         eth_broadcast_addr(mgmt_fwd->da);
@@ -1179,7 +1183,7 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
         u16 pre_value;
         bool fwd_csa = true;
         size_t baselen;
-        u8 *pos, ttl;
+        u8 *pos;
 
         if (mgmt->u.action.u.measurement.action_code !=
             WLAN_ACTION_SPCT_CHL_SWITCH)
@@ -1190,8 +1194,8 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
                            u.action.u.chan_switch.variable);
         ieee802_11_parse_elems(pos, len - baselen, false, &elems);
 
-        ttl = elems.mesh_chansw_params_ie->mesh_ttl;
-        if (!--ttl)
+        ifmsh->chsw_ttl = elems.mesh_chansw_params_ie->mesh_ttl;
+        if (!--ifmsh->chsw_ttl)
                 fwd_csa = false;
 
         pre_value = le16_to_cpu(elems.mesh_chansw_params_ie->mesh_pre_value);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 33bcf8018d8e..900ead344f5b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1915,6 +1915,8 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
                 already = true;
 
+        ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
+
         mutex_unlock(&sdata->local->mtx);
 
         if (already)
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index b91655a0d8f0..d2ed18d82fe1 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -226,7 +226,7 @@ minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
                 nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
 
         nsecs += minstrel_mcs_groups[group].duration[rate];
-        tp = 1000000 * ((mr->probability * 1000) / nsecs);
+        tp = 1000000 * ((prob * 1000) / nsecs);
 
         mr->cur_tp = MINSTREL_TRUNC(tp);
 }
@@ -277,13 +277,15 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
                         if (!(mg->supported & BIT(i)))
                                 continue;
 
+                        index = MCS_GROUP_RATES * group + i;
+
                         /* initialize rates selections starting indexes */
                         if (!mg_rates_valid) {
                                 mg->max_tp_rate = mg->max_tp_rate2 =
                                         mg->max_prob_rate = i;
                                 if (!mi_rates_valid) {
                                         mi->max_tp_rate = mi->max_tp_rate2 =
-                                                mi->max_prob_rate = i;
+                                                mi->max_prob_rate = index;
                                         mi_rates_valid = true;
                                 }
                                 mg_rates_valid = true;
@@ -291,7 +293,6 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
 
                         mr = &mg->rates[i];
                         mr->retry_updated = false;
-                        index = MCS_GROUP_RATES * group + i;
                         minstrel_calc_rate_ewma(mr);
                         minstrel_ht_calc_tp(mi, group, i);
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 30ac6099da06..2dfa75522733 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -924,7 +924,8 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
         u16 sc;
         u8 tid, ack_policy;
 
-        if (!ieee80211_is_data_qos(hdr->frame_control))
+        if (!ieee80211_is_data_qos(hdr->frame_control) ||
+            is_multicast_ether_addr(hdr->addr1))
                 goto dont_reorder;
 
         /*
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index c22cbb57b49d..4d73c46df862 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -1088,6 +1088,6 @@ void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
 
         trace_api_sched_scan_stopped(local);
 
-        ieee80211_queue_work(&local->hw, &local->sched_scan_stopped_work);
+        schedule_work(&local->sched_scan_stopped_work);
 }
 EXPORT_SYMBOL(ieee80211_sched_scan_stopped);
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index a40da20b32e0..6ab009070084 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -78,6 +78,8 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
         if (elems->mesh_chansw_params_ie) {
                 csa_ie->ttl = elems->mesh_chansw_params_ie->mesh_ttl;
                 csa_ie->mode = elems->mesh_chansw_params_ie->mesh_flags;
+                csa_ie->pre_value = le16_to_cpu(
+                                elems->mesh_chansw_params_ie->mesh_pre_value);
         }
 
         new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 06265d7f8cc3..875e172c001c 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2301,17 +2301,15 @@ void ieee80211_dfs_radar_detected_work(struct work_struct *work)
 {
         struct ieee80211_local *local =
                 container_of(work, struct ieee80211_local, radar_detected_work);
-        struct cfg80211_chan_def chandef;
+        struct cfg80211_chan_def chandef = local->hw.conf.chandef;
 
         ieee80211_dfs_cac_cancel(local);
 
         if (local->use_chanctx)
                 /* currently not handled */
                 WARN_ON(1);
-        else {
-                chandef = local->hw.conf.chandef;
+        else
                 cfg80211_radar_event(local->hw.wiphy, &chandef, GFP_KERNEL);
-        }
 }
 
 void ieee80211_radar_detected(struct ieee80211_hw *hw)
@@ -2481,13 +2479,8 @@ int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
                           WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT : 0x00;
                 put_unaligned_le16(WLAN_REASON_MESH_CHAN, pos); /* Reason Cd */
                 pos += 2;
-                if (!ifmsh->pre_value)
-                        ifmsh->pre_value = 1;
-                else
-                        ifmsh->pre_value++;
                 put_unaligned_le16(ifmsh->pre_value, pos);/* Precedence Value */
                 pos += 2;
-                ifmsh->chsw_init = true;
         }
 
         ieee80211_tx_skb(sdata, skb);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index fc968c861ee4..06db6eb5258a 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -449,6 +449,15 @@ int wiphy_register(struct wiphy *wiphy)
         int i;
         u16 ifmodes = wiphy->interface_modes;
 
+        /* support for 5/10 MHz is broken due to nl80211 API mess - disable */
+        wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_5_10_MHZ;
+
+        /*
+         * There are major locking problems in nl80211/mac80211 for CSA,
+         * disable for all drivers until this has been reworked.
+         */
+        wiphy->flags &= ~WIPHY_FLAG_HAS_CHANNEL_SWITCH;
+
 #ifdef CONFIG_PM
         if (WARN_ON(wiphy->wowlan &&
                     (wiphy->wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index f79105712949..730147ed8e65 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -262,7 +262,7 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
 
         /* try to find an IBSS channel if none requested ... */
         if (!wdev->wext.ibss.chandef.chan) {
-                wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                struct ieee80211_channel *new_chan = NULL;
 
                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                         struct ieee80211_supported_band *sband;
@@ -278,18 +278,19 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                                         continue;
                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
                                         continue;
-                                wdev->wext.ibss.chandef.chan = chan;
-                                wdev->wext.ibss.chandef.center_freq1 =
-                                        chan->center_freq;
+                                new_chan = chan;
                                 break;
                         }
 
-                        if (wdev->wext.ibss.chandef.chan)
+                        if (new_chan)
                                 break;
                 }
 
-                if (!wdev->wext.ibss.chandef.chan)
+                if (!new_chan)
                         return -EINVAL;
+
+                cfg80211_chandef_create(&wdev->wext.ibss.chandef, new_chan,
+                                        NL80211_CHAN_NO_HT);
         }
 
         /* don't join -- SSID is not there */
@@ -363,9 +364,8 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                 return err;
 
         if (chan) {
-                wdev->wext.ibss.chandef.chan = chan;
-                wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
-                wdev->wext.ibss.chandef.center_freq1 = freq;
+                cfg80211_chandef_create(&wdev->wext.ibss.chandef, chan,
+                                        NL80211_CHAN_NO_HT);
                 wdev->wext.ibss.channel_fixed = true;
         } else {
                 /* cfg80211_ibss_wext_join will pick one if needed */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index efaa23e562b4..a693f86e5970 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2688,7 +2688,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                              NL80211_CMD_NEW_KEY);
         if (!hdr)
-                return -ENOBUFS;
+                goto nla_put_failure;
 
         cookie.msg = msg;
         cookie.idx = key_idx;
@@ -5365,6 +5365,10 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                                 err = -EINVAL;
                                 goto out_free;
                         }
+
+                        if (!wiphy->bands[band])
+                                continue;
+
                         err = ieee80211_get_ratemask(wiphy->bands[band],
                                                      nla_data(attr),
                                                      nla_len(attr),
@@ -9649,8 +9653,9 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
                 goto nla_put_failure;
 
-        if (req->flags)
-                nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
+        if (req->flags &&
+            nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
+                goto nla_put_failure;
 
         return 0;
  nla_put_failure:
@@ -11106,6 +11111,8 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
                 struct nlattr *reasons;
 
                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
+                if (!reasons)
+                        goto free_msg;
 
                 if (wakeup->disconnect &&
                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
@@ -11131,16 +11138,18 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
                                 wakeup->pattern_idx))
                         goto free_msg;
 
-                if (wakeup->tcp_match)
-                        nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
+                if (wakeup->tcp_match &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
+                        goto free_msg;
 
-                if (wakeup->tcp_connlost)
-                        nla_put_flag(msg,
-                                     NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
+                if (wakeup->tcp_connlost &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
+                        goto free_msg;
 
-                if (wakeup->tcp_nomoretokens)
-                        nla_put_flag(msg,
-                                NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
+                if (wakeup->tcp_nomoretokens &&
+                    nla_put_flag(msg,
+                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
+                        goto free_msg;
 
                 if (wakeup->packet) {
                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
@@ -11276,24 +11285,29 @@ void cfg80211_ft_event(struct net_device *netdev,
                 return;
 
         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
-        if (!hdr) {
-                nlmsg_free(msg);
-                return;
-        }
+        if (!hdr)
+                goto out;
 
-        nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
-        nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
-        nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
-        if (ft_event->ies)
-                nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
-        if (ft_event->ric_ies)
-                nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
-                        ft_event->ric_ies);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
+                goto out;
+
+        if (ft_event->ies &&
+            nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
+                goto out;
+        if (ft_event->ric_ies &&
+            nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
+                    ft_event->ric_ies))
+                goto out;
 
         genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
                                 NL80211_MCGRP_MLME, GFP_KERNEL);
+        return;
+ out:
+        nlmsg_free(msg);
 }
 EXPORT_SYMBOL(cfg80211_ft_event);