9 files changed, 39 insertions, 13 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 05f3a313db88..7371f676cf41 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2594,6 +2594,9 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
                 else
                         local->probe_req_reg--;
 
+                if (!local->open_count)
+                        break;
+
                 ieee80211_queue_work(&local->hw, &local->reconfig_filter);
                 break;
         default:
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index bf87c70ac6c5..c21e33d1abd0 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1151,10 +1151,6 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
         mutex_lock(&sdata->u.ibss.mtx);
 
-        sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
-        memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
-        sdata->u.ibss.ssid_len = 0;
-
         active_ibss = ieee80211_sta_active_ibss(sdata);
 
         if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
@@ -1175,6 +1171,10 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
                 }
         }
 
+        ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
+        memset(ifibss->bssid, 0, ETH_ALEN);
+        ifibss->ssid_len = 0;
+
         sta_info_flush(sdata->local, sdata);
 
         spin_lock_bh(&ifibss->incomplete_lock);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 8c804550465b..156e5835e37f 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1314,6 +1314,8 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
                                          struct net_device *dev);
 netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                                        struct net_device *dev);
+void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
+                              struct sk_buff_head *skbs);
 
 /* HT */
 void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index c80c4490351c..f57f597972f8 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -871,8 +871,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                                 local->hw.wiphy->cipher_suites,
                                 sizeof(u32) * local->hw.wiphy->n_cipher_suites,
                                 GFP_KERNEL);
-                        if (!suites)
-                                return -ENOMEM;
+                        if (!suites) {
+                                result = -ENOMEM;
+                                goto fail_wiphy_register;
+                        }
                         for (r = 0; r < local->hw.wiphy->n_cipher_suites; r++) {
                                 u32 suite = local->hw.wiphy->cipher_suites[r];
                                 if (suite == WLAN_CIPHER_SUITE_WEP40 ||
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index c4cdbde24fd3..43e60b5a7546 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -917,7 +917,7 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                                        struct cfg80211_sched_scan_request *req)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_sched_scan_ies sched_scan_ies;
+        struct ieee80211_sched_scan_ies sched_scan_ies = {};
         int ret, i;
 
         mutex_lock(&local->mtx);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 0a4e4c04db89..d2eb64e12353 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -117,8 +117,8 @@ static void free_sta_work(struct work_struct *wk)
 
         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                 local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
-                __skb_queue_purge(&sta->ps_tx_buf[ac]);
-                __skb_queue_purge(&sta->tx_filtered[ac]);
+                ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
+                ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
         }
 
 #ifdef CONFIG_MAC80211_MESH
@@ -141,7 +141,7 @@ static void free_sta_work(struct work_struct *wk)
                 tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
                 if (!tid_tx)
                         continue;
-                __skb_queue_purge(&tid_tx->pending);
+                ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
                 kfree(tid_tx);
         }
 
@@ -961,6 +961,7 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
         struct ieee80211_local *local = sdata->local;
         struct sk_buff_head pending;
         int filtered = 0, buffered = 0, ac;
+        unsigned long flags;
 
         clear_sta_flag(sta, WLAN_STA_SP);
 
@@ -976,12 +977,16 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                 int count = skb_queue_len(&pending), tmp;
 
+                spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
                 skb_queue_splice_tail_init(&sta->tx_filtered[ac], &pending);
+                spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
                 tmp = skb_queue_len(&pending);
                 filtered += tmp - count;
                 count = tmp;
 
+                spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
                 skb_queue_splice_tail_init(&sta->ps_tx_buf[ac], &pending);
+                spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
                 tmp = skb_queue_len(&pending);
                 buffered += tmp - count;
         }
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 3af0cc4130f1..101eb88a2b78 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -668,3 +668,12 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb)
         dev_kfree_skb_any(skb);
 }
 EXPORT_SYMBOL(ieee80211_free_txskb);
+
+void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
+                              struct sk_buff_head *skbs)
+{
+        struct sk_buff *skb;
+
+        while ((skb = __skb_dequeue(skbs)))
+                ieee80211_free_txskb(hw, skb);
+}
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c9bf83f36657..b858ebe41fda 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1358,7 +1358,7 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
                 if (tx->skb)
                         ieee80211_free_txskb(&tx->local->hw, tx->skb);
                 else
-                        __skb_queue_purge(&tx->skbs);
+                        ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
                 return -1;
         } else if (unlikely(res == TX_QUEUED)) {
                 I802_DEBUG_INC(tx->local->tx_handlers_queued);
@@ -2120,10 +2120,13 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
  */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local)
 {
+        struct sk_buff *skb;
         int i;
 
-        for (i = 0; i < local->hw.queues; i++)
-                skb_queue_purge(&local->pending[i]);
+        for (i = 0; i < local->hw.queues; i++) {
+                while ((skb = skb_dequeue(&local->pending[i])) != NULL)
+                        ieee80211_free_txskb(&local->hw, skb);
+        }
 }
 
 /*
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 239391807ca9..0151ae33c4cd 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1491,6 +1491,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 list_for_each_entry(sdata, &local->interfaces, list) {
                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                                 continue;
+                        if (!sdata->u.mgd.associated)
+                                continue;
 
                         ieee80211_send_nullfunc(local, sdata, 0);
                 }