6 files changed, 27 insertions, 13 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index fb6a1502b6df..343da1e35025 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3458,7 +3458,7 @@ static int ieee80211_cfg_get_channel(struct wiphy *wiphy,
         rcu_read_lock();
         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
         if (chanctx_conf) {
-                *chandef = chanctx_conf->def;
+                *chandef = sdata->vif.bss_conf.chandef;
                 ret = 0;
         } else if (local->open_count > 0 &&
                    local->open_count == local->monitors &&
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 8fdadfd94ba8..6081329784dd 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -448,7 +448,7 @@ static void rate_fixup_ratelist(struct ieee80211_vif *vif,
          */
         if (!(rates[0].flags & IEEE80211_TX_RC_MCS)) {
                 u32 basic_rates = vif->bss_conf.basic_rates;
-                s8 baserate = basic_rates ? ffs(basic_rates - 1) : 0;
+                s8 baserate = basic_rates ? ffs(basic_rates) - 1 : 0;
 
                 rate = &sband->bitrates[rates[0].idx];
 
diff --git a/net/mac80211/rc80211_minstrel_debugfs.c b/net/mac80211/rc80211_minstrel_debugfs.c
index edde723f9f00..2acab1bcaa4b 100644
--- a/net/mac80211/rc80211_minstrel_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_debugfs.c
@@ -62,14 +62,14 @@ minstrel_stats_open(struct inode *inode, struct file *file)
         unsigned int i, tp, prob, eprob;
         char *p;
 
-        ms = kmalloc(sizeof(*ms) + 4096, GFP_KERNEL);
+        ms = kmalloc(2048, GFP_KERNEL);
         if (!ms)
                 return -ENOMEM;
 
         file->private_data = ms;
         p = ms->buf;
-        p += sprintf(p, "rate      throughput  ewma prob  this prob  "
-                        "this succ/attempt   success    attempts\n");
+        p += sprintf(p, "rate          tpt eprob *prob"
+                        "  *ok(*cum)        ok(      cum)\n");
         for (i = 0; i < mi->n_rates; i++) {
                 struct minstrel_rate *mr = &mi->r[i];
                 struct minstrel_rate_stats *mrs = &mi->r[i].stats;
@@ -86,8 +86,8 @@ minstrel_stats_open(struct inode *inode, struct file *file)
                 prob = MINSTREL_TRUNC(mrs->cur_prob * 1000);
                 eprob = MINSTREL_TRUNC(mrs->probability * 1000);
 
-                p += sprintf(p, "  %6u.%1u   %6u.%1u   %6u.%1u        "
-                                "   %3u(%3u)  %8llu    %8llu\n",
+                p += sprintf(p, " %4u.%1u %3u.%1u %3u.%1u"
+                                " %4u(%4u) %9llu(%9llu)\n",
                                 tp / 10, tp % 10,
                                 eprob / 10, eprob % 10,
                                 prob / 10, prob % 10,
@@ -102,6 +102,8 @@ minstrel_stats_open(struct inode *inode, struct file *file)
                         mi->sample_packets);
         ms->len = p - ms->buf;
 
+        WARN_ON(ms->len + sizeof(*ms) > 2048);
+
         return 0;
 }
 
diff --git a/net/mac80211/rc80211_minstrel_ht_debugfs.c b/net/mac80211/rc80211_minstrel_ht_debugfs.c
index a72ad46f2a04..d537bec93754 100644
--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
@@ -63,8 +63,8 @@ minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
                 prob = MINSTREL_TRUNC(mr->cur_prob * 1000);
                 eprob = MINSTREL_TRUNC(mr->probability * 1000);
 
-                p += sprintf(p, "      %6u.%1u   %6u.%1u    %6u.%1u    "
-                                "%3u            %3u(%3u)  %8llu    %8llu\n",
+                p += sprintf(p, " %4u.%1u %3u.%1u %3u.%1u "
+                                "%3u %4u(%4u) %9llu(%9llu)\n",
                                 tp / 10, tp % 10,
                                 eprob / 10, eprob % 10,
                                 prob / 10, prob % 10,
@@ -96,14 +96,15 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
                 return ret;
         }
 
-        ms = kmalloc(sizeof(*ms) + 8192, GFP_KERNEL);
+        ms = kmalloc(8192, GFP_KERNEL);
         if (!ms)
                 return -ENOMEM;
 
         file->private_data = ms;
         p = ms->buf;
-        p += sprintf(p, "type           rate     throughput  ewma prob   "
-                     "this prob  retry   this succ/attempt   success    attempts\n");
+        p += sprintf(p, "type           rate     tpt eprob *prob "
+                        "ret  *ok(*cum)        ok(      cum)\n");
+
 
         p = minstrel_ht_stats_dump(mi, max_mcs, p);
         for (i = 0; i < max_mcs; i++)
@@ -118,6 +119,8 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
                 MINSTREL_TRUNC(mi->avg_ampdu_len * 10) % 10);
         ms->len = p - ms->buf;
 
+        WARN_ON(ms->len + sizeof(*ms) > 8192);
+
         return nonseekable_open(inode, file);
 }
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 42f68cb8957e..bcda2ac7d844 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -336,6 +336,7 @@ struct ieee80211_tx_latency_stat {
  * @known_smps_mode: the smps_mode the client thinks we are in. Relevant for
  *      AP only.
  * @cipher_scheme: optional cipher scheme for this station
+ * @last_tdls_pkt_time: holds the time in jiffies of last TDLS pkt ACKed
  */
 struct sta_info {
         /* General information, mostly static */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index cb9f5a44ffad..5839c85075f1 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5927,6 +5927,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         int err;
         bool need_new_beacon = false;
         int len, i;
+        u32 cs_count;
 
         if (!rdev->ops->channel_switch ||
             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
@@ -5963,7 +5964,14 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
                 return -EINVAL;
 
-        params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
+        /* Even though the attribute is u32, the specification says
+         * u8, so let's make sure we don't overflow.
+         */
+        cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
+        if (cs_count > 255)
+                return -EINVAL;
+
+        params.count = cs_count;
 
         if (!need_new_beacon)
                 goto skip_beacons;