18 files changed, 85 insertions, 37 deletions

diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index c54b7d37bff1..420d69b2674c 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -143,6 +143,7 @@ struct ath_common {
         u32 keymax;
         DECLARE_BITMAP(keymap, ATH_KEYMAX);
         DECLARE_BITMAP(tkip_keymap, ATH_KEYMAX);
+        DECLARE_BITMAP(ccmp_keymap, ATH_KEYMAX);
         enum ath_crypt_caps crypt_caps;
 
         unsigned int clockrate;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 1c68e564f503..995ca8e1302e 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -622,7 +622,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
 
         if (NR_CPUS > 1 && ah->config.serialize_regmode == SER_REG_MODE_AUTO) {
                 if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI ||
-                    ((AR_SREV_9160(ah) || AR_SREV_9280(ah)) &&
+                    ((AR_SREV_9160(ah) || AR_SREV_9280(ah) || AR_SREV_9287(ah)) &&
                      !ah->is_pciexpress)) {
                         ah->config.serialize_regmode =
                                 SER_REG_MODE_ON;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index e1fcc68124dc..0735aeb3b26c 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -695,9 +695,9 @@ static bool ath_edma_get_buffers(struct ath_softc *sc,
                         __skb_unlink(skb, &rx_edma->rx_fifo);
                         list_add_tail(&bf->list, &sc->rx.rxbuf);
                         ath_rx_edma_buf_link(sc, qtype);
-                } else {
-                        bf = NULL;
                 }
+
+                bf = NULL;
         }
 
         *dest = bf;
@@ -822,7 +822,8 @@ static bool ath9k_rx_accept(struct ath_common *common,
          * descriptor does contain a valid key index. This has been observed
          * mostly with CCMP encryption.
          */
-        if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID)
+        if (rx_stats->rs_keyix == ATH9K_RXKEYIX_INVALID ||
+            !test_bit(rx_stats->rs_keyix, common->ccmp_keymap))
                 rx_stats->rs_status &= ~ATH9K_RXERR_KEYMISS;
 
         if (!rx_stats->rs_datalen) {
diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c
index 0e81904956cf..5c54aa43ca2d 100644
--- a/drivers/net/wireless/ath/key.c
+++ b/drivers/net/wireless/ath/key.c
@@ -556,6 +556,9 @@ int ath_key_config(struct ath_common *common,
                 return -EIO;
 
         set_bit(idx, common->keymap);
+        if (key->cipher == WLAN_CIPHER_SUITE_CCMP)
+                set_bit(idx, common->ccmp_keymap);
+
         if (key->cipher == WLAN_CIPHER_SUITE_TKIP) {
                 set_bit(idx + 64, common->keymap);
                 set_bit(idx, common->tkip_keymap);
@@ -582,6 +585,7 @@ void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key)
                 return;
 
         clear_bit(key->hw_key_idx, common->keymap);
+        clear_bit(key->hw_key_idx, common->ccmp_keymap);
         if (key->cipher != WLAN_CIPHER_SUITE_TKIP)
                 return;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-mac80211.c b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
index 3ee23134c02b..013680332f07 100644
--- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c
+++ b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
@@ -796,6 +796,18 @@ int iwlagn_mac_sta_state(struct ieee80211_hw *hw,
         switch (op) {
         case ADD:
                 ret = iwlagn_mac_sta_add(hw, vif, sta);
+                if (ret)
+                        break;
+                /*
+                 * Clear the in-progress flag, the AP station entry was added
+                 * but we'll initialize LQ only when we've associated (which
+                 * would also clear the in-progress flag). This is necessary
+                 * in case we never initialize LQ because association fails.
+                 */
+                spin_lock_bh(&priv->sta_lock);
+                priv->stations[iwl_sta_id(sta)].used &=
+                        ~IWL_STA_UCODE_INPROGRESS;
+                spin_unlock_bh(&priv->sta_lock);
                 break;
         case REMOVE:
                 ret = iwlagn_mac_sta_remove(hw, vif, sta);
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index 9c44088054dd..900ee129e825 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -256,7 +256,8 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         else
                 last_seq = priv->rx_seq[tid];
 
-        if (last_seq >= new_node->start_win)
+        if (last_seq != MWIFIEX_DEF_11N_RX_SEQ_NUM &&
+            last_seq >= new_node->start_win)
                 new_node->start_win = last_seq + 1;
 
         new_node->win_size = win_size;
@@ -596,5 +597,5 @@ void mwifiex_11n_cleanup_reorder_tbl(struct mwifiex_private *priv)
         spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
 
         INIT_LIST_HEAD(&priv->rx_reorder_tbl_ptr);
-        memset(priv->rx_seq, 0, sizeof(priv->rx_seq));
+        mwifiex_reset_11n_rx_seq_num(priv);
 }
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.h b/drivers/net/wireless/mwifiex/11n_rxreorder.h
index f1bffebabc60..6c9815a0f5d8 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.h
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.h
@@ -37,6 +37,13 @@
 
 #define ADDBA_RSP_STATUS_ACCEPT 0
 
+#define MWIFIEX_DEF_11N_RX_SEQ_NUM      0xffff
+
+static inline void mwifiex_reset_11n_rx_seq_num(struct mwifiex_private *priv)
+{
+        memset(priv->rx_seq, 0xff, sizeof(priv->rx_seq));
+}
+
 int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *,
                                u16 seqNum,
                                u16 tid, u8 *ta,
diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c
index ceb82cd749cc..383820a52beb 100644
--- a/drivers/net/wireless/mwifiex/ie.c
+++ b/drivers/net/wireless/mwifiex/ie.c
@@ -213,6 +213,7 @@ mwifiex_update_uap_custom_ie(struct mwifiex_private *priv,
                 /* save assoc resp ie index after auto-indexing */
                 *assoc_idx = *((u16 *)pos);
 
+        kfree(ap_custom_ie);
         return ret;
 }
 
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index e0377473282f..fc8a9bfa1248 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -978,10 +978,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
                 dev_dbg(adapter->dev, "info: --- Rx: Event ---\n");
                 adapter->event_cause = *(u32 *) skb->data;
 
-                skb_pull(skb, MWIFIEX_EVENT_HEADER_LEN);
-
                 if ((skb->len > 0) && (skb->len  < MAX_EVENT_SIZE))
-                        memcpy(adapter->event_body, skb->data, skb->len);
+                        memcpy(adapter->event_body,
+                               skb->data + MWIFIEX_EVENT_HEADER_LEN,
+                               skb->len);
 
                 /* event cause has been saved to adapter->event_cause */
                 adapter->event_received = true;
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index 4ace5a3dcd23..11e731f3581c 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -406,9 +406,9 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                 break;
 
         case EVENT_UAP_STA_ASSOC:
-                skb_pull(adapter->event_skb, MWIFIEX_UAP_EVENT_EXTRA_HEADER);
                 memset(&sinfo, 0, sizeof(sinfo));
-                event = (struct mwifiex_assoc_event *)adapter->event_skb->data;
+                event = (struct mwifiex_assoc_event *)
+                        (adapter->event_body + MWIFIEX_UAP_EVENT_EXTRA_HEADER);
                 if (le16_to_cpu(event->type) == TLV_TYPE_UAP_MGMT_FRAME) {
                         len = -1;
 
@@ -433,9 +433,8 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                                  GFP_KERNEL);
                 break;
         case EVENT_UAP_STA_DEAUTH:
-                skb_pull(adapter->event_skb, MWIFIEX_UAP_EVENT_EXTRA_HEADER);
-                cfg80211_del_sta(priv->netdev, adapter->event_skb->data,
-                                 GFP_KERNEL);
+                cfg80211_del_sta(priv->netdev, adapter->event_body +
+                                 MWIFIEX_UAP_EVENT_EXTRA_HEADER, GFP_KERNEL);
                 break;
         case EVENT_UAP_BSS_IDLE:
                 priv->media_connected = false;
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 49ebf20c56eb..22a5916564b8 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -49,6 +49,7 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
         struct device *dev = adapter->dev;
         u32 recv_type;
         __le32 tmp;
+        int ret;
 
         if (adapter->hs_activated)
                 mwifiex_process_hs_config(adapter);
@@ -69,16 +70,19 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
                 case MWIFIEX_USB_TYPE_CMD:
                         if (skb->len > MWIFIEX_SIZE_OF_CMD_BUFFER) {
                                 dev_err(dev, "CMD: skb->len too large\n");
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                         } else if (!adapter->curr_cmd) {
                                 dev_dbg(dev, "CMD: no curr_cmd\n");
                                 if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
                                         mwifiex_process_sleep_confirm_resp(
                                                         adapter, skb->data,
                                                         skb->len);
-                                        return 0;
+                                        ret = 0;
+                                        goto exit_restore_skb;
                                 }
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                         }
 
                         adapter->curr_cmd->resp_skb = skb;
@@ -87,20 +91,22 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
                 case MWIFIEX_USB_TYPE_EVENT:
                         if (skb->len < sizeof(u32)) {
                                 dev_err(dev, "EVENT: skb->len too small\n");
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                         }
                         skb_copy_from_linear_data(skb, &tmp, sizeof(u32));
                         adapter->event_cause = le32_to_cpu(tmp);
-                        skb_pull(skb, sizeof(u32));
                         dev_dbg(dev, "event_cause %#x\n", adapter->event_cause);
 
                         if (skb->len > MAX_EVENT_SIZE) {
                                 dev_err(dev, "EVENT: event body too large\n");
-                                return -1;
+                                ret = -1;
+                                goto exit_restore_skb;
                         }
 
-                        skb_copy_from_linear_data(skb, adapter->event_body,
-                                                  skb->len);
+                        memcpy(adapter->event_body, skb->data +
+                               MWIFIEX_EVENT_HEADER_LEN, skb->len);
+
                         adapter->event_received = true;
                         adapter->event_skb = skb;
                         break;
@@ -124,6 +130,12 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter,
         }
 
         return -EINPROGRESS;
+
+exit_restore_skb:
+        /* The buffer will be reused for further cmds/events */
+        skb_push(skb, INTF_HEADER_LEN);
+
+        return ret;
 }
 
 static void mwifiex_usb_rx_complete(struct urb *urb)
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index f3fc65515857..3fa4d4176993 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -404,6 +404,8 @@ mwifiex_wmm_init(struct mwifiex_adapter *adapter)
                 priv->add_ba_param.tx_win_size = MWIFIEX_AMPDU_DEF_TXWINSIZE;
                 priv->add_ba_param.rx_win_size = MWIFIEX_AMPDU_DEF_RXWINSIZE;
 
+                mwifiex_reset_11n_rx_seq_num(priv);
+
                 atomic_set(&priv->wmm.tx_pkts_queued, 0);
                 atomic_set(&priv->wmm.highest_queued_prio, HIGH_PRIO_TID);
         }
@@ -1221,6 +1223,7 @@ mwifiex_dequeue_tx_packet(struct mwifiex_adapter *adapter)
 
         if (!ptr->is_11n_enabled ||
             mwifiex_is_ba_stream_setup(priv, ptr, tid) ||
+            priv->wps.session_enable ||
             ((priv->sec_info.wpa_enabled ||
               priv->sec_info.wpa2_enabled) &&
              !priv->wpa_is_gtk_set)) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index d228358e6a40..9970c2b1b199 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -301,9 +301,11 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
         {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
         {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
+        {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
         {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
         {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
         {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+        {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
         /* HP - Lite-On ,8188CUS Slim Combo */
         {RTL_USB_DEVICE(0x103c, 0x1629, rtl92cu_hal_cfg)},
         {RTL_USB_DEVICE(0x13d3, 0x3357, rtl92cu_hal_cfg)}, /* AzureWave */
@@ -346,6 +348,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(0x07b8, 0x8178, rtl92cu_hal_cfg)}, /*Funai -Abocom*/
         {RTL_USB_DEVICE(0x0846, 0x9021, rtl92cu_hal_cfg)}, /*Netgear-Sercomm*/
         {RTL_USB_DEVICE(0x0b05, 0x17ab, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
+        {RTL_USB_DEVICE(0x0bda, 0x8186, rtl92cu_hal_cfg)}, /*Realtek 92CE-VAU*/
         {RTL_USB_DEVICE(0x0df6, 0x0061, rtl92cu_hal_cfg)}, /*Sitecom-Edimax*/
         {RTL_USB_DEVICE(0x0e66, 0x0019, rtl92cu_hal_cfg)}, /*Hawking-Edimax*/
         {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
diff --git a/drivers/net/wireless/ti/wlcore/Kconfig b/drivers/net/wireless/ti/wlcore/Kconfig
index 54156b0b5c2d..d7b907e67170 100644
--- a/drivers/net/wireless/ti/wlcore/Kconfig
+++ b/drivers/net/wireless/ti/wlcore/Kconfig
@@ -1,7 +1,6 @@
 config WLCORE
         tristate "TI wlcore support"
         depends on WL_TI && GENERIC_HARDIRQS && MAC80211
-        depends on INET
         select FW_LOADER
         ---help---
           This module contains the main code for TI WLAN chips.  It abstracts
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 66e4fcdd1c6b..a4bb856de08f 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1342,7 +1342,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         u32 changed = 0;
-        u8 bssid[ETH_ALEN];
 
         ASSERT_MGD_MTX(ifmgd);
 
@@ -1354,10 +1353,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_stop_poll(sdata);
 
-        memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
-
         ifmgd->associated = NULL;
-        memset(ifmgd->bssid, 0, ETH_ALEN);
 
         /*
          * we need to commit the associated = NULL change because the
@@ -1377,7 +1373,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         netif_carrier_off(sdata->dev);
 
         mutex_lock(&local->sta_mtx);
-        sta = sta_info_get(sdata, bssid);
+        sta = sta_info_get(sdata, ifmgd->bssid);
         if (sta) {
                 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
                 ieee80211_sta_tear_down_BA_sessions(sta, tx);
@@ -1386,13 +1382,16 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         /* deauthenticate/disassociate now */
         if (tx || frame_buf)
-                ieee80211_send_deauth_disassoc(sdata, bssid, stype, reason,
-                                               tx, frame_buf);
+                ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
+                                               reason, tx, frame_buf);
 
         /* flush out frame */
         if (tx)
                 drv_flush(local, false);
 
+        /* clear bssid only after building the needed mgmt frames */
+        memset(ifmgd->bssid, 0, ETH_ALEN);
+
         /* remove AP and TDLS peers */
         sta_info_flush(local, sdata);
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7bcecf73aafb..965e6ec0adb6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2455,7 +2455,7 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
          * frames that we didn't handle, including returning unknown
          * ones. For all other modes we will return them to the sender,
          * setting the 0x80 bit in the action category, as required by
-         * 802.11-2007 7.3.1.11.
+         * 802.11-2012 9.24.4.
          * Newer versions of hostapd shall also use the management frame
          * registration mechanisms, but older ones still use cooked
          * monitor interfaces so push all frames there.
@@ -2465,6 +2465,9 @@ ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
              sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
                 return RX_DROP_MONITOR;
 
+        if (is_multicast_ether_addr(mgmt->da))
+                return RX_DROP_MONITOR;
+
         /* do not return rejected action frames */
         if (mgmt->u.action.category & 0x80)
                 return RX_DROP_UNUSABLE;
diff --git a/net/nfc/nci/ntf.c b/net/nfc/nci/ntf.c
index cb2646179e5f..2ab196a9f228 100644
--- a/net/nfc/nci/ntf.c
+++ b/net/nfc/nci/ntf.c
@@ -106,7 +106,7 @@ static __u8 *nci_extract_rf_params_nfca_passive_poll(struct nci_dev *ndev,
         nfca_poll->sens_res = __le16_to_cpu(*((__u16 *)data));
         data += 2;
 
-        nfca_poll->nfcid1_len = *data++;
+        nfca_poll->nfcid1_len = min_t(__u8, *data++, NFC_NFCID1_MAXSIZE);
 
         pr_debug("sens_res 0x%x, nfcid1_len %d\n",
                  nfca_poll->sens_res, nfca_poll->nfcid1_len);
@@ -130,7 +130,7 @@ static __u8 *nci_extract_rf_params_nfcb_passive_poll(struct nci_dev *ndev,
                         struct rf_tech_specific_params_nfcb_poll *nfcb_poll,
                                                      __u8 *data)
 {
-        nfcb_poll->sensb_res_len = *data++;
+        nfcb_poll->sensb_res_len = min_t(__u8, *data++, NFC_SENSB_RES_MAXSIZE);
 
         pr_debug("sensb_res_len %d\n", nfcb_poll->sensb_res_len);
 
@@ -145,7 +145,7 @@ static __u8 *nci_extract_rf_params_nfcf_passive_poll(struct nci_dev *ndev,
                                                      __u8 *data)
 {
         nfcf_poll->bit_rate = *data++;
-        nfcf_poll->sensf_res_len = *data++;
+        nfcf_poll->sensf_res_len = min_t(__u8, *data++, NFC_SENSF_RES_MAXSIZE);
 
         pr_debug("bit_rate %d, sensf_res_len %d\n",
                  nfcf_poll->bit_rate, nfcf_poll->sensf_res_len);
@@ -331,7 +331,7 @@ static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev,
         switch (ntf->activation_rf_tech_and_mode) {
         case NCI_NFC_A_PASSIVE_POLL_MODE:
                 nfca_poll = &ntf->activation_params.nfca_poll_iso_dep;
-                nfca_poll->rats_res_len = *data++;
+                nfca_poll->rats_res_len = min_t(__u8, *data++, 20);
                 pr_debug("rats_res_len %d\n", nfca_poll->rats_res_len);
                 if (nfca_poll->rats_res_len > 0) {
                         memcpy(nfca_poll->rats_res,
@@ -341,7 +341,7 @@ static int nci_extract_activation_params_iso_dep(struct nci_dev *ndev,
 
         case NCI_NFC_B_PASSIVE_POLL_MODE:
                 nfcb_poll = &ntf->activation_params.nfcb_poll_iso_dep;
-                nfcb_poll->attrib_res_len = *data++;
+                nfcb_poll->attrib_res_len = min_t(__u8, *data++, 50);
                 pr_debug("attrib_res_len %d\n", nfcb_poll->attrib_res_len);
                 if (nfcb_poll->attrib_res_len > 0) {
                         memcpy(nfcb_poll->attrib_res,
diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index ec1134c9e07f..8b8a6a2b2bad 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -54,7 +54,10 @@ static int rawsock_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
 
-        pr_debug("sock=%p\n", sock);
+        pr_debug("sock=%p sk=%p\n", sock, sk);
+
+        if (!sk)
+                return 0;
 
         sock_orphan(sk);
         sock_put(sk);