11 files changed, 106 insertions, 35 deletions

diff --git a/net/ieee80211/Kconfig b/net/ieee80211/Kconfig
index dbb08528ddf5..f7e84e9d13ad 100644
--- a/net/ieee80211/Kconfig
+++ b/net/ieee80211/Kconfig
@@ -58,6 +58,7 @@ config IEEE80211_CRYPT_TKIP
         depends on IEEE80211 && NET_RADIO
         select CRYPTO
         select CRYPTO_MICHAEL_MIC
+        select CRC32
         ---help---
         Include software based cipher suites in support of IEEE 802.11i
         (aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with TKIP enabled
diff --git a/net/ieee80211/ieee80211_crypt.c b/net/ieee80211/ieee80211_crypt.c
index cb71d794a7d1..5ed0a98b2d76 100644
--- a/net/ieee80211/ieee80211_crypt.c
+++ b/net/ieee80211/ieee80211_crypt.c
@@ -110,11 +110,10 @@ int ieee80211_register_crypto_ops(struct ieee80211_crypto_ops *ops)
         unsigned long flags;
         struct ieee80211_crypto_alg *alg;
 
-        alg = kmalloc(sizeof(*alg), GFP_KERNEL);
+        alg = kzalloc(sizeof(*alg), GFP_KERNEL);
         if (alg == NULL)
                 return -ENOMEM;
 
-        memset(alg, 0, sizeof(*alg));
         alg->ops = ops;
 
         spin_lock_irqsave(&ieee80211_crypto_lock, flags);
diff --git a/net/ieee80211/ieee80211_crypt_ccmp.c b/net/ieee80211/ieee80211_crypt_ccmp.c
index 492647382ad0..ed90a8af1444 100644
--- a/net/ieee80211/ieee80211_crypt_ccmp.c
+++ b/net/ieee80211/ieee80211_crypt_ccmp.c
@@ -76,10 +76,9 @@ static void *ieee80211_ccmp_init(int key_idx)
 {
         struct ieee80211_ccmp_data *priv;
 
-        priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
+        priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
         if (priv == NULL)
                 goto fail;
-        memset(priv, 0, sizeof(*priv));
         priv->key_idx = key_idx;
 
         priv->tfm = crypto_alloc_tfm("aes", 0);
diff --git a/net/ieee80211/ieee80211_crypt_wep.c b/net/ieee80211/ieee80211_crypt_wep.c
index c5a87724aabe..0ebf235f6939 100644
--- a/net/ieee80211/ieee80211_crypt_wep.c
+++ b/net/ieee80211/ieee80211_crypt_wep.c
@@ -39,10 +39,9 @@ static void *prism2_wep_init(int keyidx)
 {
         struct prism2_wep_data *priv;
 
-        priv = kmalloc(sizeof(*priv), GFP_ATOMIC);
+        priv = kzalloc(sizeof(*priv), GFP_ATOMIC);
         if (priv == NULL)
                 goto fail;
-        memset(priv, 0, sizeof(*priv));
         priv->key_idx = keyidx;
 
         priv->tfm = crypto_alloc_tfm("arc4", 0);
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 47ccf159372c..72d4d4e04d42 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -368,6 +368,7 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 
         /* Put this code here so that we avoid duplicating it in all
          * Rx paths. - Jean II */
+#ifdef CONFIG_WIRELESS_EXT
 #ifdef IW_WIRELESS_SPY          /* defined in iw_handler.h */
         /* If spy monitoring on */
         if (ieee->spy_data.spy_number > 0) {
@@ -396,15 +397,16 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
                 wireless_spy_update(ieee->dev, hdr->addr2, &wstats);
         }
 #endif                          /* IW_WIRELESS_SPY */
+#endif                          /* CONFIG_WIRELESS_EXT */
 
 #ifdef NOT_YET
         hostap_update_rx_stats(local->ap, hdr, rx_stats);
 #endif
 
         if (ieee->iw_mode == IW_MODE_MONITOR) {
-                ieee80211_monitor_rx(ieee, skb, rx_stats);
                 stats->rx_packets++;
                 stats->rx_bytes += skb->len;
+                ieee80211_monitor_rx(ieee, skb, rx_stats);
                 return 1;
         }
 
diff --git a/net/ieee80211/ieee80211_tx.c b/net/ieee80211/ieee80211_tx.c
index de148ae594f3..bf042139c7ab 100644
--- a/net/ieee80211/ieee80211_tx.c
+++ b/net/ieee80211/ieee80211_tx.c
@@ -562,10 +562,13 @@ int ieee80211_tx_frame(struct ieee80211_device *ieee,
         struct net_device_stats *stats = &ieee->stats;
         struct sk_buff *skb_frag;
         int priority = -1;
+        int fraglen = total_len;
+        int headroom = ieee->tx_headroom;
+        struct ieee80211_crypt_data *crypt = ieee->crypt[ieee->tx_keyidx];
 
         spin_lock_irqsave(&ieee->lock, flags);
 
-        if (encrypt_mpdu && !ieee->sec.encrypt)
+        if (encrypt_mpdu && (!ieee->sec.encrypt || !crypt))
                 encrypt_mpdu = 0;
 
         /* If there is no driver handler to take the TXB, dont' bother
@@ -581,20 +584,24 @@ int ieee80211_tx_frame(struct ieee80211_device *ieee,
                 goto success;
         }
 
-        if (encrypt_mpdu)
+        if (encrypt_mpdu) {
                 frame->frame_ctl |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+                fraglen += crypt->ops->extra_mpdu_prefix_len +
+                           crypt->ops->extra_mpdu_postfix_len;
+                headroom += crypt->ops->extra_mpdu_prefix_len;
+        }
 
         /* When we allocate the TXB we allocate enough space for the reserve
          * and full fragment bytes (bytes_per_frag doesn't include prefix,
          * postfix, header, FCS, etc.) */
-        txb = ieee80211_alloc_txb(1, total_len, ieee->tx_headroom, GFP_ATOMIC);
+        txb = ieee80211_alloc_txb(1, fraglen, headroom, GFP_ATOMIC);
         if (unlikely(!txb)) {
                 printk(KERN_WARNING "%s: Could not allocate TXB\n",
                        ieee->dev->name);
                 goto failed;
         }
         txb->encrypted = 0;
-        txb->payload_size = total_len;
+        txb->payload_size = fraglen;
 
         skb_frag = txb->fragments[0];
 
diff --git a/net/ieee80211/ieee80211_wx.c b/net/ieee80211/ieee80211_wx.c
index a78c4f845f66..5cb9cfd35397 100644
--- a/net/ieee80211/ieee80211_wx.c
+++ b/net/ieee80211/ieee80211_wx.c
@@ -369,11 +369,10 @@ int ieee80211_wx_set_encode(struct ieee80211_device *ieee,
                 struct ieee80211_crypt_data *new_crypt;
 
                 /* take WEP into use */
-                new_crypt = kmalloc(sizeof(struct ieee80211_crypt_data),
+                new_crypt = kzalloc(sizeof(struct ieee80211_crypt_data),
                                     GFP_KERNEL);
                 if (new_crypt == NULL)
                         return -ENOMEM;
-                memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
                 new_crypt->ops = ieee80211_get_crypto_ops("WEP");
                 if (!new_crypt->ops) {
                         request_module("ieee80211_crypt_wep");
@@ -616,13 +615,11 @@ int ieee80211_wx_set_encodeext(struct ieee80211_device *ieee,
 
                 ieee80211_crypt_delayed_deinit(ieee, crypt);
 
-                new_crypt = (struct ieee80211_crypt_data *)
-                    kmalloc(sizeof(*new_crypt), GFP_KERNEL);
+                new_crypt = kzalloc(sizeof(*new_crypt), GFP_KERNEL);
                 if (new_crypt == NULL) {
                         ret = -ENOMEM;
                         goto done;
                 }
-                memset(new_crypt, 0, sizeof(struct ieee80211_crypt_data));
                 new_crypt->ops = ops;
                 if (new_crypt->ops && try_module_get(new_crypt->ops->owner))
                         new_crypt->priv = new_crypt->ops->init(idx);
diff --git a/net/ieee80211/softmac/ieee80211softmac_assoc.c b/net/ieee80211/softmac/ieee80211softmac_assoc.c
index 5e9a90651d04..44215ce64d4e 100644
--- a/net/ieee80211/softmac/ieee80211softmac_assoc.c
+++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c
@@ -47,9 +47,7 @@ ieee80211softmac_assoc(struct ieee80211softmac_device *mac, struct ieee80211soft
         
         dprintk(KERN_INFO PFX "sent association request!\n");
 
-        /* Change the state to associating */
         spin_lock_irqsave(&mac->lock, flags);
-        mac->associnfo.associating = 1;
         mac->associated = 0; /* just to make sure */
 
         /* Set a timer for timeout */
@@ -63,6 +61,7 @@ void
 ieee80211softmac_assoc_timeout(void *d)
 {
         struct ieee80211softmac_device *mac = (struct ieee80211softmac_device *)d;
+        struct ieee80211softmac_network *n;
         unsigned long flags;
 
         spin_lock_irqsave(&mac->lock, flags);
@@ -75,11 +74,12 @@ ieee80211softmac_assoc_timeout(void *d)
         mac->associnfo.associating = 0;
         mac->associnfo.bssvalid = 0;
         mac->associated = 0;
+
+        n = ieee80211softmac_get_network_by_bssid_locked(mac, mac->associnfo.bssid);
         spin_unlock_irqrestore(&mac->lock, flags);
 
         dprintk(KERN_INFO PFX "assoc request timed out!\n");
-        /* FIXME: we need to know the network here. that requires a bit of restructuring */
-        ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_TIMEOUT, NULL);
+        ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_TIMEOUT, n);
 }
 
 void
@@ -203,6 +203,10 @@ ieee80211softmac_assoc_work(void *d)
         if (mac->associated)
                 ieee80211softmac_send_disassoc_req(mac, WLAN_REASON_DISASSOC_STA_HAS_LEFT);
 
+        spin_lock_irqsave(&mac->lock, flags);
+        mac->associnfo.associating = 1;
+        spin_unlock_irqrestore(&mac->lock, flags);
+
         /* try to find the requested network in our list, if we found one already */
         if (bssvalid || mac->associnfo.bssfixed)
                 found = ieee80211softmac_get_network_by_bssid(mac, mac->associnfo.bssid);       
@@ -295,19 +299,32 @@ ieee80211softmac_assoc_work(void *d)
         memcpy(mac->associnfo.associate_essid.data, found->essid.data, IW_ESSID_MAX_SIZE + 1);
         
         /* we found a network! authenticate (if necessary) and associate to it. */
-        if (!found->authenticated) {
+        if (found->authenticating) {
+                dprintk(KERN_INFO PFX "Already requested authentication, waiting...\n");
+                if(!mac->associnfo.assoc_wait) {
+                        mac->associnfo.assoc_wait = 1;
+                        ieee80211softmac_notify_internal(mac, IEEE80211SOFTMAC_EVENT_ANY, found, ieee80211softmac_assoc_notify_auth, NULL, GFP_KERNEL);
+                }
+                return;
+        }
+        if (!found->authenticated && !found->authenticating) {
                 /* This relies on the fact that _auth_req only queues the work,
                  * otherwise adding the notification would be racy. */
                 if (!ieee80211softmac_auth_req(mac, found)) {
-                        dprintk(KERN_INFO PFX "cannot associate without being authenticated, requested authentication\n");
-                        ieee80211softmac_notify_internal(mac, IEEE80211SOFTMAC_EVENT_ANY, found, ieee80211softmac_assoc_notify_auth, NULL, GFP_KERNEL);
+                        if(!mac->associnfo.assoc_wait) {
+                                dprintk(KERN_INFO PFX "Cannot associate without being authenticated, requested authentication\n");
+                                mac->associnfo.assoc_wait = 1;
+                                ieee80211softmac_notify_internal(mac, IEEE80211SOFTMAC_EVENT_ANY, found, ieee80211softmac_assoc_notify_auth, NULL, GFP_KERNEL);
+                        }
                 } else {
                         printkl(KERN_WARNING PFX "Not authenticated, but requesting authentication failed. Giving up to associate\n");
+                        mac->associnfo.assoc_wait = 0;
                         ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_FAILED, found);
                 }
                 return;
         }
         /* finally! now we can start associating */
+        mac->associnfo.assoc_wait = 0;
         ieee80211softmac_assoc(mac, found);
 }
 
diff --git a/net/ieee80211/softmac/ieee80211softmac_auth.c b/net/ieee80211/softmac/ieee80211softmac_auth.c
index 90b8484e509b..4cef39e171d0 100644
--- a/net/ieee80211/softmac/ieee80211softmac_auth.c
+++ b/net/ieee80211/softmac/ieee80211softmac_auth.c
@@ -36,8 +36,9 @@ ieee80211softmac_auth_req(struct ieee80211softmac_device *mac,
         struct ieee80211softmac_auth_queue_item *auth;
         unsigned long flags;
         
-        if (net->authenticating)
+        if (net->authenticating || net->authenticated)
                 return 0;
+        net->authenticating = 1;
 
         /* Add the network if it's not already added */
         ieee80211softmac_add_network(mac, net);
@@ -92,7 +93,6 @@ ieee80211softmac_auth_queue(void *data)
                         return;
                 }
                 net->authenticated = 0;
-                net->authenticating = 1;
                 /* add a timeout call so we eventually give up waiting for an auth reply */
                 schedule_delayed_work(&auth->work, IEEE80211SOFTMAC_AUTH_TIMEOUT);
                 auth->retry--;
@@ -116,6 +116,16 @@ ieee80211softmac_auth_queue(void *data)
         kfree(auth);
 }
 
+/* Sends a response to an auth challenge (for shared key auth). */
+static void
+ieee80211softmac_auth_challenge_response(void *_aq)
+{
+        struct ieee80211softmac_auth_queue_item *aq = _aq;
+
+        /* Send our response */
+        ieee80211softmac_send_mgt_frame(aq->mac, aq->net, IEEE80211_STYPE_AUTH, aq->state);
+}
+
 /* Handle the auth response from the AP
  * This should be registered with ieee80211 as handle_auth 
  */
@@ -197,24 +207,30 @@ ieee80211softmac_auth_resp(struct net_device *dev, struct ieee80211_auth *auth)
                 case IEEE80211SOFTMAC_AUTH_SHARED_CHALLENGE:
                         /* Check to make sure we have a challenge IE */
                         data = (u8 *)auth->info_element;
-                        if(*data++ != MFIE_TYPE_CHALLENGE){
+                        if (*data++ != MFIE_TYPE_CHALLENGE) {
                                 printkl(KERN_NOTICE PFX "Shared Key Authentication failed due to a missing challenge.\n");
                                 break;  
                         }
                         /* Save the challenge */
                         spin_lock_irqsave(&mac->lock, flags);
                         net->challenge_len = *data++;   
-                        if(net->challenge_len > WLAN_AUTH_CHALLENGE_LEN)
+                        if (net->challenge_len > WLAN_AUTH_CHALLENGE_LEN)
                                 net->challenge_len = WLAN_AUTH_CHALLENGE_LEN;
-                        if(net->challenge != NULL)
+                        if (net->challenge != NULL)
                                 kfree(net->challenge);
                         net->challenge = kmalloc(net->challenge_len, GFP_ATOMIC);
                         memcpy(net->challenge, data, net->challenge_len);
                         aq->state = IEEE80211SOFTMAC_AUTH_SHARED_RESPONSE; 
-                        spin_unlock_irqrestore(&mac->lock, flags);
 
-                        /* Send our response */
-                        ieee80211softmac_send_mgt_frame(mac, aq->net, IEEE80211_STYPE_AUTH, aq->state);
+                        /* We reuse the work struct from the auth request here.
+                         * It is safe to do so as each one is per-request, and
+                         * at this point (dealing with authentication response)
+                         * we have obviously already sent the initial auth
+                         * request. */
+                        cancel_delayed_work(&aq->work);
+                        INIT_WORK(&aq->work, &ieee80211softmac_auth_challenge_response, (void *)aq);
+                        schedule_work(&aq->work);
+                        spin_unlock_irqrestore(&mac->lock, flags);
                         return 0;
                 case IEEE80211SOFTMAC_AUTH_SHARED_PASS:
                         kfree(net->challenge);
diff --git a/net/ieee80211/softmac/ieee80211softmac_io.c b/net/ieee80211/softmac/ieee80211softmac_io.c
index 09541611e48c..6ae5a1dc7956 100644
--- a/net/ieee80211/softmac/ieee80211softmac_io.c
+++ b/net/ieee80211/softmac/ieee80211softmac_io.c
@@ -96,8 +96,7 @@ ieee80211softmac_alloc_mgt(u32 size)
         if(size > IEEE80211_DATA_LEN)
                 return NULL;
         /* Allocate the frame */
-        data = kmalloc(size, GFP_ATOMIC);
-        memset(data, 0, size);
+        data = kzalloc(size, GFP_ATOMIC);
         return data;
 }
 
@@ -229,6 +228,9 @@ ieee80211softmac_assoc_req(struct ieee80211_assoc_request **pkt,
                 return 0;
         ieee80211softmac_hdr_3addr(mac, &((*pkt)->header), IEEE80211_STYPE_ASSOC_REQ, net->bssid, net->bssid);
 
+        /* Fill in the capabilities */
+        (*pkt)->capability = ieee80211softmac_capabilities(mac, net);
+
         /* Fill in Listen Interval (?) */
         (*pkt)->listen_interval = cpu_to_le16(10);
         
diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
index 0e65ff4e33fc..75320b6842ab 100644
--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
+++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
@@ -70,12 +70,44 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
                               char *extra)
 {
         struct ieee80211softmac_device *sm = ieee80211_priv(net_dev);
+        struct ieee80211softmac_network *n;
+        struct ieee80211softmac_auth_queue_item *authptr;
         int length = 0;
         unsigned long flags;
-        
+
+        /* Check if we're already associating to this or another network
+         * If it's another network, cancel and start over with our new network
+         * If it's our network, ignore the change, we're already doing it!
+         */
+        if((sm->associnfo.associating || sm->associated) &&
+           (data->essid.flags && data->essid.length && extra)) {
+                /* Get the associating network */
+                n = ieee80211softmac_get_network_by_bssid(sm, sm->associnfo.bssid);
+                if(n && n->essid.len == (data->essid.length - 1) &&
+                   !memcmp(n->essid.data, extra, n->essid.len)) {
+                        dprintk(KERN_INFO PFX "Already associating or associated to "MAC_FMT"\n",
+                                MAC_ARG(sm->associnfo.bssid));
+                        return 0;
+                } else {
+                        dprintk(KERN_INFO PFX "Canceling existing associate request!\n");
+                        spin_lock_irqsave(&sm->lock,flags);
+                        /* Cancel assoc work */
+                        cancel_delayed_work(&sm->associnfo.work);
+                        /* We don't have to do this, but it's a little cleaner */
+                        list_for_each_entry(authptr, &sm->auth_queue, list)
+                                cancel_delayed_work(&authptr->work);
+                        sm->associnfo.bssvalid = 0;
+                        sm->associnfo.bssfixed = 0;
+                        spin_unlock_irqrestore(&sm->lock,flags);
+                        flush_scheduled_work();
+                }
+        }
+
+
         spin_lock_irqsave(&sm->lock, flags);
-        
+
         sm->associnfo.static_essid = 0;
+        sm->associnfo.assoc_wait = 0;
 
         if (data->essid.flags && data->essid.length && extra /*required?*/) {
                 length = min(data->essid.length - 1, IW_ESSID_MAX_SIZE);