1 files changed, 17 insertions, 21 deletions

diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 53c7077ffd4f..421eaa6b0c2b 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -31,7 +31,6 @@
 #define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
 
 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
-#define IEEE80211_IBSS_MERGE_DELAY 0x400000
 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
 
 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
@@ -41,7 +40,7 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
                                         struct ieee80211_mgmt *mgmt,
                                         size_t len)
 {
-        u16 auth_alg, auth_transaction, status_code;
+        u16 auth_alg, auth_transaction;
 
         lockdep_assert_held(&sdata->u.ibss.mtx);
 
@@ -50,7 +49,6 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
 
         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
-        status_code = le16_to_cpu(mgmt->u.auth.status_code);
 
         /*
          * IEEE 802.11 standard does not require authentication in IBSS
@@ -270,7 +268,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         enum ieee80211_band band = rx_status->band;
 
         if (elems->ds_params && elems->ds_params_len == 1)
-                freq = ieee80211_channel_to_frequency(elems->ds_params[0]);
+                freq = ieee80211_channel_to_frequency(elems->ds_params[0],
+                                                      band);
         else
                 freq = rx_status->freq;
 
@@ -354,7 +353,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         if (memcmp(cbss->bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0)
                 goto put_bss;
 
-        if (rx_status->flag & RX_FLAG_TSFT) {
+        if (rx_status->flag & RX_FLAG_MACTIME_MPDU) {
                 /*
                  * For correct IBSS merging we need mactime; since mactime is
                  * defined as the time the first data symbol of the frame hits
@@ -396,10 +395,6 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                jiffies);
 #endif
 
-        /* give slow hardware some time to do the TSF sync */
-        if (rx_timestamp < IEEE80211_IBSS_MERGE_DELAY)
-                goto put_bss;
-
         if (beacon_timestamp > rx_timestamp) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                 printk(KERN_DEBUG "%s: beacon TSF higher than "
@@ -531,8 +526,6 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
         u8 bssid[ETH_ALEN];
         u16 capability;
         int i;
@@ -555,8 +548,6 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
                sdata->name, bssid);
 
-        sband = local->hw.wiphy->bands[ifibss->channel->band];
-
         capability = WLAN_CAPABILITY_IBSS;
 
         if (ifibss->privacy)
@@ -663,20 +654,24 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
 }
 
 static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
-                                        struct ieee80211_mgmt *mgmt,
-                                        size_t len)
+                                        struct sk_buff *req)
 {
+        struct ieee80211_mgmt *mgmt = (void *)req->data;
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
-        int tx_last_beacon;
+        int tx_last_beacon, len = req->len;
         struct sk_buff *skb;
         struct ieee80211_mgmt *resp;
+        struct sk_buff *presp;
         u8 *pos, *end;
 
         lockdep_assert_held(&ifibss->mtx);
 
+        presp = rcu_dereference_protected(ifibss->presp,
+                                          lockdep_is_held(&ifibss->mtx));
+
         if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
-            len < 24 + 2 || !ifibss->presp)
+            len < 24 + 2 || !presp)
                 return;
 
         tx_last_beacon = drv_tx_last_beacon(local);
@@ -688,7 +683,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
                mgmt->bssid, tx_last_beacon);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
-        if (!tx_last_beacon)
+        if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
                 return;
 
         if (memcmp(mgmt->bssid, ifibss->bssid, ETH_ALEN) != 0 &&
@@ -714,7 +709,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         }
 
         /* Reply with ProbeResp */
-        skb = skb_copy(ifibss->presp, GFP_KERNEL);
+        skb = skb_copy(presp, GFP_KERNEL);
         if (!skb)
                 return;
 
@@ -785,7 +780,7 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 
         switch (fc & IEEE80211_FCTL_STYPE) {
         case IEEE80211_STYPE_PROBE_REQ:
-                ieee80211_rx_mgmt_probe_req(sdata, mgmt, skb->len);
+                ieee80211_rx_mgmt_probe_req(sdata, skb);
                 break;
         case IEEE80211_STYPE_PROBE_RESP:
                 ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
@@ -994,7 +989,8 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
         /* remove beacon */
         kfree(sdata->u.ibss.ie);
-        skb = sdata->u.ibss.presp;
+        skb = rcu_dereference_protected(sdata->u.ibss.presp,
+                                        lockdep_is_held(&sdata->u.ibss.mtx));
         rcu_assign_pointer(sdata->u.ibss.presp, NULL);
         sdata->vif.bss_conf.ibss_joined = false;
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |