2 files changed, 34 insertions, 10 deletions

diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index ec36868f6fc5..ec6d5d6b452e 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -298,6 +298,7 @@ static int lbs_add_common_rates_tlv(u8 *tlv, struct cfg80211_bss *bss)
         const u8 *rates_eid, *ext_rates_eid;
         int n = 0;
 
+        rcu_read_lock();
         rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
         ext_rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_EXT_SUPP_RATES);
 
@@ -325,6 +326,7 @@ static int lbs_add_common_rates_tlv(u8 *tlv, struct cfg80211_bss *bss)
                 *tlv++ = 0x96;
                 n = 4;
         }
+        rcu_read_unlock();
 
         rate_tlv->header.len = cpu_to_le16(n);
         return sizeof(rate_tlv->header) + n;
@@ -1140,11 +1142,13 @@ static int lbs_associate(struct lbs_private *priv,
         cmd->capability = cpu_to_le16(bss->capability);
 
         /* add SSID TLV */
+        rcu_read_lock();
         ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
         if (ssid_eid)
                 pos += lbs_add_ssid_tlv(pos, ssid_eid + 2, ssid_eid[1]);
         else
                 lbs_deb_assoc("no SSID\n");
+        rcu_read_unlock();
 
         /* add DS param TLV */
         if (bss->channel)
@@ -1782,7 +1786,7 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
         struct cfg80211_ibss_params *params,
         struct cfg80211_bss *bss)
 {
-        const u8 *rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
+        const u8 *rates_eid;
         struct cmd_ds_802_11_ad_hoc_join cmd;
         u8 preamble = RADIO_PREAMBLE_SHORT;
         int ret = 0;
@@ -1841,6 +1845,8 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
 
         /* set rates to the intersection of our rates and the rates in the
            bss */
+        rcu_read_lock();
+        rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
         if (!rates_eid) {
                 lbs_add_rates(cmd.bss.rates);
         } else {
@@ -1860,6 +1866,7 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
                         }
                 }
         }
+        rcu_read_unlock();
 
         /* Only v8 and below support setting this */
         if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8) {
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 24af6ba7d8a1..5d7b83e2dc4d 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -158,12 +158,22 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
                               struct cfg80211_bss *bss,
                               struct mwifiex_bssdescriptor *bss_desc)
 {
-        int ret;
+        int ret, beacon_ie_len;
         u8 *beacon_ie;
         struct mwifiex_bss_priv *bss_priv = (void *)bss->priv;
+        const struct cfg80211_bss_ies *ies;
+
+        rcu_read_lock();
+        ies = rcu_dereference(bss->ies);
+        if (WARN_ON(!ies)) {
+                /* should never happen */
+                rcu_read_unlock();
+                return -EINVAL;
+        }
+        beacon_ie = kmemdup(ies->data, ies->len, GFP_ATOMIC);
+        beacon_ie_len = ies->len;
+        rcu_read_unlock();
 
-        beacon_ie = kmemdup(bss->information_elements, bss->len_beacon_ies,
-                            GFP_KERNEL);
         if (!beacon_ie) {
                 dev_err(priv->adapter->dev, " failed to alloc beacon_ie\n");
                 return -ENOMEM;
@@ -172,7 +182,7 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
         memcpy(bss_desc->mac_address, bss->bssid, ETH_ALEN);
         bss_desc->rssi = bss->signal;
         bss_desc->beacon_buf = beacon_ie;
-        bss_desc->beacon_buf_size = bss->len_beacon_ies;
+        bss_desc->beacon_buf_size = beacon_ie_len;
         bss_desc->beacon_period = bss->beacon_interval;
         bss_desc->cap_info_bitmap = bss->capability;
         bss_desc->bss_band = bss_priv->band;
@@ -198,18 +208,23 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
 static int mwifiex_process_country_ie(struct mwifiex_private *priv,
                                       struct cfg80211_bss *bss)
 {
-        u8 *country_ie, country_ie_len;
+        const u8 *country_ie;
+        u8 country_ie_len;
         struct mwifiex_802_11d_domain_reg *domain_info =
                                         &priv->adapter->domain_reg;
 
-        country_ie = (u8 *)ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
-
-        if (!country_ie)
+        rcu_read_lock();
+        country_ie = ieee80211_bss_get_ie(bss, WLAN_EID_COUNTRY);
+        if (!country_ie) {
+                rcu_read_unlock();
                 return 0;
+        }
 
         country_ie_len = country_ie[1];
-        if (country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
+        if (country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN) {
+                rcu_read_unlock();
                 return 0;
+        }
 
         domain_info->country_code[0] = country_ie[2];
         domain_info->country_code[1] = country_ie[3];
@@ -223,6 +238,8 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
         memcpy((u8 *)domain_info->triplet,
                &country_ie[2] + IEEE80211_COUNTRY_STRING_LEN, country_ie_len);
 
+        rcu_read_unlock();
+
         if (mwifiex_send_cmd_async(priv, HostCmd_CMD_802_11D_DOMAIN_INFO,
                                    HostCmd_ACT_GEN_SET, 0, NULL)) {
                 wiphy_err(priv->adapter->wiphy,