7 files changed, 17 insertions, 5 deletions

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 049e507d2f82..0c3c214772e7 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1168,6 +1168,7 @@ struct cfg80211_ops {
         int     (*action)(struct wiphy *wiphy, struct net_device *dev,
                           struct ieee80211_channel *chan,
                           enum nl80211_channel_type channel_type,
+                          bool channel_type_valid,
                           const u8 *buf, size_t len, u64 *cookie);
 
         int     (*set_power_mgmt)(struct wiphy *wiphy, struct net_device *dev,
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index c7000a6ca379..f8c49c5ad8aa 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1554,10 +1554,12 @@ static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
 static int ieee80211_action(struct wiphy *wiphy, struct net_device *dev,
                             struct ieee80211_channel *chan,
                             enum nl80211_channel_type channel_type,
+                            bool channel_type_valid,
                             const u8 *buf, size_t len, u64 *cookie)
 {
         return ieee80211_mgd_action(IEEE80211_DEV_TO_SUB_IF(dev), chan,
-                                    channel_type, buf, len, cookie);
+                                    channel_type, channel_type_valid,
+                                    buf, len, cookie);
 }
 
 struct cfg80211_ops mac80211_config_ops = {
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 1a9e2da37a93..d4677efd3a36 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -988,6 +988,7 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
 int ieee80211_mgd_action(struct ieee80211_sub_if_data *sdata,
                          struct ieee80211_channel *chan,
                          enum nl80211_channel_type channel_type,
+                         bool channel_type_valid,
                          const u8 *buf, size_t len, u64 *cookie);
 ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
                                           struct sk_buff *skb);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 31e3386b8d43..29c3a75a7ad0 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2308,6 +2308,7 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
 int ieee80211_mgd_action(struct ieee80211_sub_if_data *sdata,
                          struct ieee80211_channel *chan,
                          enum nl80211_channel_type channel_type,
+                         bool channel_type_valid,
                          const u8 *buf, size_t len, u64 *cookie)
 {
         struct ieee80211_local *local = sdata->local;
@@ -2315,9 +2316,11 @@ int ieee80211_mgd_action(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb;
 
         /* Check that we are on the requested channel for transmission */
-        if ((chan != local->tmp_channel ||
-             channel_type != local->tmp_channel_type) &&
-            (chan != local->oper_channel ||
+        if (chan != local->tmp_channel &&
+            chan != local->oper_channel)
+                return -EBUSY;
+        if (channel_type_valid &&
+            (channel_type != local->tmp_channel_type &&
              channel_type != local->_oper_channel_type))
                 return -EBUSY;
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index ae930acf75e9..63d57ae399c3 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -339,6 +339,7 @@ int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
                          struct net_device *dev,
                          struct ieee80211_channel *chan,
                          enum nl80211_channel_type channel_type,
+                         bool channel_type_valid,
                          const u8 *buf, size_t len, u64 *cookie);
 
 /* SME */
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 48ead6f0426d..f69ae19f497f 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -827,6 +827,7 @@ int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
                          struct net_device *dev,
                          struct ieee80211_channel *chan,
                          enum nl80211_channel_type channel_type,
+                         bool channel_type_valid,
                          const u8 *buf, size_t len, u64 *cookie)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -855,7 +856,7 @@ int cfg80211_mlme_action(struct cfg80211_registered_device *rdev,
 
         /* Transmit the Action frame as requested by user space */
         return rdev->ops->action(&rdev->wiphy, dev, chan, channel_type,
-                                 buf, len, cookie);
+                                 channel_type_valid, buf, len, cookie);
 }
 
 bool cfg80211_rx_action(struct net_device *dev, int freq, const u8 *buf,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index db71150b8040..90ab3c8519be 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4681,6 +4681,7 @@ static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
         struct net_device *dev;
         struct ieee80211_channel *chan;
         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+        bool channel_type_valid = false;
         u32 freq;
         int err;
         void *hdr;
@@ -4722,6 +4723,7 @@ static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
                         err = -EINVAL;
                         goto out;
                 }
+                channel_type_valid = true;
         }
 
         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
@@ -4745,6 +4747,7 @@ static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
                 goto free_msg;
         }
         err = cfg80211_mlme_action(rdev, dev, chan, channel_type,
+                                   channel_type_valid,
                                    nla_data(info->attrs[NL80211_ATTR_FRAME]),
                                    nla_len(info->attrs[NL80211_ATTR_FRAME]),
                                    &cookie);