10 files changed, 82 insertions, 41 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 699d97b8de5e..a9fce4afdf21 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -672,7 +672,7 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (params->vlan) {
                 sdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 
-                if (sdata->vif.type != IEEE80211_IF_TYPE_VLAN ||
+                if (sdata->vif.type != IEEE80211_IF_TYPE_VLAN &&
                     sdata->vif.type != IEEE80211_IF_TYPE_AP)
                         return -EINVAL;
         } else
@@ -760,7 +760,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
         if (params->vlan && params->vlan != sta->sdata->dev) {
                 vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 
-                if (vlansdata->vif.type != IEEE80211_IF_TYPE_VLAN ||
+                if (vlansdata->vif.type != IEEE80211_IF_TYPE_VLAN &&
                     vlansdata->vif.type != IEEE80211_IF_TYPE_AP) {
                         rcu_read_unlock();
                         return -EINVAL;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c7314bf4bec2..006486b26726 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -899,7 +899,7 @@ extern const struct iw_handler_def ieee80211_iw_handler_def;
 
 
 /* ieee80211_ioctl.c */
-int ieee80211_set_freq(struct ieee80211_local *local, int freq);
+int ieee80211_set_freq(struct net_device *dev, int freq);
 /* ieee80211_sta.c */
 void ieee80211_sta_timer(unsigned long data);
 void ieee80211_sta_work(struct work_struct *work);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 150d66dbda9d..220e83be3ef4 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -380,6 +380,15 @@ void ieee80211_key_free(struct ieee80211_key *key)
         if (!key)
                 return;
 
+        if (!key->sdata) {
+                /* The key has not been linked yet, simply free it
+                 * and don't Oops */
+                if (key->conf.alg == ALG_CCMP)
+                        ieee80211_aes_key_free(key->u.ccmp.tfm);
+                kfree(key);
+                return;
+        }
+
         spin_lock_irqsave(&key->sdata->local->key_lock, flags);
         __ieee80211_key_free(key);
         spin_unlock_irqrestore(&key->sdata->local->key_lock, flags);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 915afadb0602..98c0b5e56ecc 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -511,6 +511,7 @@ static int ieee80211_stop(struct net_device *dev)
         case IEEE80211_IF_TYPE_STA:
         case IEEE80211_IF_TYPE_IBSS:
                 sdata->u.sta.state = IEEE80211_DISABLED;
+                memset(sdata->u.sta.bssid, 0, ETH_ALEN);
                 del_timer_sync(&sdata->u.sta.timer);
                 /*
                  * When we get here, the interface is marked down.
@@ -1313,7 +1314,7 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
         /*
          * Clear the TX filter mask for this STA when sending the next
          * packet. If the STA went to power save mode, this will happen
-         * happen when it wakes up for the next time.
+         * when it wakes up for the next time.
          */
         sta->flags |= WLAN_STA_CLEAR_PS_FILT;
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 7cfd12e0d1e2..4d2b582dd055 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -44,7 +44,7 @@
 #define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
 #define IEEE80211_SCAN_INTERVAL (2 * HZ)
 #define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
-#define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ)
+#define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
 
 #define IEEE80211_PROBE_DELAY (HZ / 33)
 #define IEEE80211_CHANNEL_TIME (HZ / 33)
@@ -1325,7 +1325,7 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
 
         /* prepare reordering buffer */
         tid_agg_rx->reorder_buf =
-                kmalloc(buf_size * sizeof(struct sk_buf *), GFP_ATOMIC);
+                kmalloc(buf_size * sizeof(struct sk_buff *), GFP_ATOMIC);
         if (!tid_agg_rx->reorder_buf) {
                 if (net_ratelimit())
                         printk(KERN_ERR "can not allocate reordering buffer "
@@ -1334,7 +1334,7 @@ static void ieee80211_sta_process_addba_request(struct net_device *dev,
                 goto end;
         }
         memset(tid_agg_rx->reorder_buf, 0,
-                buf_size * sizeof(struct sk_buf *));
+                buf_size * sizeof(struct sk_buff *));
 
         if (local->ops->ampdu_action)
                 ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_RX_START,
@@ -1614,7 +1614,7 @@ void sta_addba_resp_timer_expired(unsigned long data)
          * only one argument, and both sta_info and TID are needed, so init
          * flow in sta_info_create gives the TID as data, while the timer_to_id
          * array gives the sta through container_of */
-        u16 tid = *(int *)data;
+        u16 tid = *(u8 *)data;
         struct sta_info *temp_sta = container_of((void *)data,
                 struct sta_info, timer_to_tid[tid]);
 
@@ -1662,7 +1662,7 @@ timer_expired_exit:
 void sta_rx_agg_session_timer_expired(unsigned long data)
 {
         /* not an elegant detour, but there is no choice as the timer passes
-         * only one argument, and verious sta_info are needed here, so init
+         * only one argument, and various sta_info are needed here, so init
          * flow in sta_info_create gives the TID as data, while the timer_to_id
          * array gives the sta through container_of */
         u8 *ptid = (u8 *)data;
@@ -2336,6 +2336,7 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
         u8 *pos;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_supported_band *sband;
+        union iwreq_data wrqu;
 
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
@@ -2358,13 +2359,10 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
         sdata->drop_unencrypted = bss->capability &
                 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
 
-        res = ieee80211_set_freq(local, bss->freq);
+        res = ieee80211_set_freq(dev, bss->freq);
 
-        if (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS) {
-                printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
-                       "%d MHz\n", dev->name, local->oper_channel->center_freq);
-                return -1;
-        }
+        if (res)
+                return res;
 
         /* Set beacon template */
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
@@ -2479,7 +2477,9 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
         ifsta->state = IEEE80211_IBSS_JOINED;
         mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
 
-        ieee80211_rx_bss_put(dev, bss);
+        memset(&wrqu, 0, sizeof(wrqu));
+        memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
+        wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
 
         return res;
 }
@@ -3488,7 +3488,7 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
         spin_unlock_bh(&local->sta_bss_lock);
 
         if (selected) {
-                ieee80211_set_freq(local, selected->freq);
+                ieee80211_set_freq(dev, selected->freq);
                 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
                         ieee80211_sta_set_ssid(dev, selected->ssid,
                                                selected->ssid_len);
@@ -3523,6 +3523,7 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
         struct ieee80211_supported_band *sband;
         u8 bssid[ETH_ALEN], *pos;
         int i;
+        int ret;
         DECLARE_MAC_BUF(mac);
 
 #if 0
@@ -3567,7 +3568,9 @@ static int ieee80211_sta_create_ibss(struct net_device *dev,
                 *pos++ = (u8) (rate / 5);
         }
 
-        return ieee80211_sta_join_ibss(dev, ifsta, bss);
+        ret = ieee80211_sta_join_ibss(dev, ifsta, bss);
+        ieee80211_rx_bss_put(dev, bss);
+        return ret;
 }
 
 
@@ -3615,10 +3618,13 @@ static int ieee80211_sta_find_ibss(struct net_device *dev,
             (bss = ieee80211_rx_bss_get(dev, bssid,
                                         local->hw.conf.channel->center_freq,
                                         ifsta->ssid, ifsta->ssid_len))) {
+                int ret;
                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %s"
                        " based on configured SSID\n",
                        dev->name, print_mac(mac, bssid));
-                return ieee80211_sta_join_ibss(dev, ifsta, bss);
+                ret = ieee80211_sta_join_ibss(dev, ifsta, bss);
+                ieee80211_rx_bss_put(dev, bss);
+                return ret;
         }
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "   did not try to join ibss\n");
@@ -4095,18 +4101,17 @@ ieee80211_sta_scan_result(struct net_device *dev,
 
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = bss->freq;
-        iwe.u.freq.e = 6;
+        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
+        iwe.u.freq.e = 0;
         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
 
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
-        iwe.u.freq.m = ieee80211_frequency_to_channel(bss->freq);
-        iwe.u.freq.e = 0;
+        iwe.u.freq.m = bss->freq;
+        iwe.u.freq.e = 6;
         current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                           IW_EV_FREQ_LEN);
-
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = IWEVQUAL;
         iwe.u.qual.qual = bss->signal;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 1958bfb361c6..0941e5d6a522 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1091,7 +1091,7 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
         u16 fc, hdrlen, ethertype;
         u8 *payload;
         u8 dst[ETH_ALEN];
-        u8 src[ETH_ALEN];
+        u8 src[ETH_ALEN] __aligned(2);
         struct sk_buff *skb = rx->skb;
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         DECLARE_MAC_BUF(mac);
@@ -1234,7 +1234,7 @@ ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
  */
 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx)
 {
-        static const u8 pae_group_addr[ETH_ALEN]
+        static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
                 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 1d7dd54aacef..c80d5899f279 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1132,7 +1132,7 @@ static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
         ieee80211_tx_handler *handler;
         struct ieee80211_tx_data tx;
         ieee80211_tx_result res = TX_DROP, res_prepare;
-        int ret, i;
+        int ret, i, retries = 0;
 
         WARN_ON(__ieee80211_queue_pending(local, control->queue));
 
@@ -1216,6 +1216,13 @@ retry:
                 if (!__ieee80211_queue_stopped(local, control->queue)) {
                         clear_bit(IEEE80211_LINK_STATE_PENDING,
                                   &local->state[control->queue]);
+                        retries++;
+                        /*
+                         * Driver bug, it's rejecting packets but
+                         * not stopping queues.
+                         */
+                        if (WARN_ON_ONCE(retries > 5))
+                                goto drop;
                         goto retry;
                 }
                 memcpy(&store->control, control,
@@ -1562,13 +1569,13 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
          * be cloned. This could happen, e.g., with Linux bridge code passing
          * us broadcast frames. */
 
-        if (head_need > 0 || skb_header_cloned(skb)) {
+        if (head_need > 0 || skb_cloned(skb)) {
 #if 0
                 printk(KERN_DEBUG "%s: need to reallocate buffer for %d bytes "
                        "of headroom\n", dev->name, head_need);
 #endif
 
-                if (skb_header_cloned(skb))
+                if (skb_cloned(skb))
                         I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
                 else
                         I802_DEBUG_INC(local->tx_expand_skb_head);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 131e9e6c8a32..4e97b266f907 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -34,11 +34,11 @@ void *mac80211_wiphy_privid = &mac80211_wiphy_privid;
 
 /* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
 /* Ethernet-II snap header (RFC1042 for most EtherTypes) */
-const unsigned char rfc1042_header[] =
+const unsigned char rfc1042_header[] __aligned(2) =
         { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
 
 /* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
-const unsigned char bridge_tunnel_header[] =
+const unsigned char bridge_tunnel_header[] __aligned(2) =
         { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
 
 
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 457ebf9e85ae..e8404212ad57 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -95,6 +95,13 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
                         }
                 }
 
+                if (alg == ALG_WEP &&
+                        key_len != LEN_WEP40 && key_len != LEN_WEP104) {
+                        ieee80211_key_free(key);
+                        err = -EINVAL;
+                        goto out_unlock;
+                }
+
                 ieee80211_key_link(key, sdata, sta);
 
                 if (set_tx_key || (!sta && !sdata->default_key && key))
@@ -290,14 +297,22 @@ static int ieee80211_ioctl_giwmode(struct net_device *dev,
         return 0;
 }
 
-int ieee80211_set_freq(struct ieee80211_local *local, int freqMHz)
+int ieee80211_set_freq(struct net_device *dev, int freqMHz)
 {
         int ret = -EINVAL;
         struct ieee80211_channel *chan;
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         chan = ieee80211_get_channel(local->hw.wiphy, freqMHz);
 
         if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
+                if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
+                    chan->flags & IEEE80211_CHAN_NO_IBSS) {
+                        printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
+                                "%d MHz\n", dev->name, chan->center_freq);
+                        return ret;
+                }
                 local->oper_channel = chan;
 
                 if (local->sta_sw_scanning || local->sta_hw_scanning)
@@ -315,7 +330,6 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                    struct iw_request_info *info,
                                    struct iw_freq *freq, char *extra)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         if (sdata->vif.type == IEEE80211_IF_TYPE_STA)
@@ -329,14 +343,14 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
                                         IEEE80211_STA_AUTO_CHANNEL_SEL;
                         return 0;
                 } else
-                        return ieee80211_set_freq(local,
+                        return ieee80211_set_freq(dev,
                                 ieee80211_channel_to_frequency(freq->m));
         } else {
                 int i, div = 1000000;
                 for (i = 0; i < freq->e; i++)
                         div /= 10;
                 if (div > 0)
-                        return ieee80211_set_freq(local, freq->m / div);
+                        return ieee80211_set_freq(dev, freq->m / div);
                 else
                         return -EINVAL;
         }
@@ -489,9 +503,15 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
             sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
-                ap_addr->sa_family = ARPHRD_ETHER;
-                memcpy(&ap_addr->sa_data, sdata->u.sta.bssid, ETH_ALEN);
-                return 0;
+                if (sdata->u.sta.state == IEEE80211_ASSOCIATED ||
+                    sdata->u.sta.state == IEEE80211_IBSS_JOINED) {
+                        ap_addr->sa_family = ARPHRD_ETHER;
+                        memcpy(&ap_addr->sa_data, sdata->u.sta.bssid, ETH_ALEN);
+                        return 0;
+                } else {
+                        memset(&ap_addr->sa_data, 0, ETH_ALEN);
+                        return 0;
+                }
         } else if (sdata->vif.type == IEEE80211_IF_TYPE_WDS) {
                 ap_addr->sa_family = ARPHRD_ETHER;
                 memcpy(&ap_addr->sa_data, sdata->u.wds.remote_addr, ETH_ALEN);
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index dc1598b86004..5d09e8698b57 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -323,8 +323,7 @@ static void wme_qdiscop_destroy(struct Qdisc* qd)
         struct ieee80211_hw *hw = &local->hw;
         int queue;
 
-        tcf_destroy_chain(q->filter_list);
-        q->filter_list = NULL;
+        tcf_destroy_chain(&q->filter_list);
 
         for (queue=0; queue < hw->queues; queue++) {
                 skb_queue_purge(&q->requeued[queue]);
@@ -673,7 +672,7 @@ int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
 #ifdef CONFIG_MAC80211_HT_DEBUG
                         if (net_ratelimit())
                                 printk(KERN_DEBUG "allocated aggregation queue"
-                                        " %d tid %d addr %s pool=0x%lX",
+                                        " %d tid %d addr %s pool=0x%lX\n",
                                         i, tid, print_mac(mac, sta->addr),
                                         q->qdisc_pool[0]);
 #endif /* CONFIG_MAC80211_HT_DEBUG */