1 files changed, 323 insertions, 96 deletions

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 48260c2d092a..6bc7c4b32fa5 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -98,7 +98,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
-        [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
+        [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 
         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
@@ -132,8 +132,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 
-        [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
-                                         .len = NL80211_HT_CAPABILITY_LEN },
+        [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 
         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
@@ -197,6 +196,9 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
+        [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
+        [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
+                                      .len = IEEE80211_MAX_DATA_LEN },
 };
 
 /* policy for the key attributes */
@@ -204,7 +206,7 @@ static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
         [NL80211_KEY_IDX] = { .type = NLA_U8 },
         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
-        [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
+        [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
@@ -759,6 +761,10 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
                     dev->wiphy.available_antennas_rx);
 
+        if (dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD)
+                NLA_PUT_U32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
+                            dev->wiphy.probe_resp_offload);
+
         if ((dev->wiphy.available_antennas_tx ||
              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
                 u32 tx_ant = 0, rx_ant = 0;
@@ -891,6 +897,11 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         }
         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
                 CMD(sched_scan_start, START_SCHED_SCAN);
+        CMD(probe_client, PROBE_CLIENT);
+        if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
+                i++;
+                NLA_PUT_U32(msg, i, NL80211_CMD_REGISTER_BEACONS);
+        }
 
 #undef CMD
 
@@ -1008,6 +1019,12 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
                 goto nla_put_failure;
 
+        if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME)
+                NLA_PUT_U32(msg, NL80211_ATTR_DEVICE_AP_SME,
+                            dev->wiphy.ap_sme_capa);
+
+        NLA_PUT_U32(msg, NL80211_ATTR_FEATURE_FLAGS, dev->wiphy.features);
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -1253,6 +1270,12 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         goto bad_res;
                 }
 
+                if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+                    netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
+                        result = -EINVAL;
+                        goto bad_res;
+                }
+
                 nla_for_each_nested(nl_txq_params,
                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
                                     rem_txq_params) {
@@ -2150,6 +2173,13 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
         }
 
+        if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
+                params.probe_resp =
+                        nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
+                params.probe_resp_len =
+                        nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
+        }
+
         err = call(&rdev->wiphy, dev, &params);
         if (!err && params.interval)
                 wdev->beacon_interval = params.interval;
@@ -5266,12 +5296,13 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
         bool channel_type_valid = false;
         u32 freq;
         int err;
-        void *hdr;
+        void *hdr = NULL;
         u64 cookie;
-        struct sk_buff *msg;
+        struct sk_buff *msg = NULL;
         unsigned int wait = 0;
-        bool offchan;
-        bool no_cck;
+        bool offchan, no_cck, dont_wait_for_ack;
+
+        dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
 
         if (!info->attrs[NL80211_ATTR_FRAME] ||
             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
@@ -5315,29 +5346,36 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
         if (chan == NULL)
                 return -EINVAL;
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-        if (!msg)
-                return -ENOMEM;
+        if (!dont_wait_for_ack) {
+                msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+                if (!msg)
+                        return -ENOMEM;
 
-        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
-                             NL80211_CMD_FRAME);
+                hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
+                                     NL80211_CMD_FRAME);
 
-        if (IS_ERR(hdr)) {
-                err = PTR_ERR(hdr);
-                goto free_msg;
+                if (IS_ERR(hdr)) {
+                        err = PTR_ERR(hdr);
+                        goto free_msg;
+                }
         }
+
         err = cfg80211_mlme_mgmt_tx(rdev, dev, chan, offchan, channel_type,
                                     channel_type_valid, wait,
                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
-                                    no_cck, &cookie);
+                                    no_cck, dont_wait_for_ack, &cookie);
         if (err)
                 goto free_msg;
 
-        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+        if (msg) {
+                NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
 
-        genlmsg_end(msg, hdr);
-        return genlmsg_reply(msg, info);
+                genlmsg_end(msg, hdr);
+                return genlmsg_reply(msg, info);
+        }
+
+        return 0;
 
  nla_put_failure:
         err = -ENOBUFS;
@@ -5827,6 +5865,91 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
+static int nl80211_register_unexpected_frame(struct sk_buff *skb,
+                                             struct genl_info *info)
+{
+        struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+
+        if (wdev->iftype != NL80211_IFTYPE_AP &&
+            wdev->iftype != NL80211_IFTYPE_P2P_GO)
+                return -EINVAL;
+
+        if (wdev->ap_unexpected_nlpid)
+                return -EBUSY;
+
+        wdev->ap_unexpected_nlpid = info->snd_pid;
+        return 0;
+}
+
+static int nl80211_probe_client(struct sk_buff *skb,
+                                struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct sk_buff *msg;
+        void *hdr;
+        const u8 *addr;
+        u64 cookie;
+        int err;
+
+        if (wdev->iftype != NL80211_IFTYPE_AP &&
+            wdev->iftype != NL80211_IFTYPE_P2P_GO)
+                return -EOPNOTSUPP;
+
+        if (!info->attrs[NL80211_ATTR_MAC])
+                return -EINVAL;
+
+        if (!rdev->ops->probe_client)
+                return -EOPNOTSUPP;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
+                             NL80211_CMD_PROBE_CLIENT);
+
+        if (IS_ERR(hdr)) {
+                err = PTR_ERR(hdr);
+                goto free_msg;
+        }
+
+        addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
+
+        err = rdev->ops->probe_client(&rdev->wiphy, dev, addr, &cookie);
+        if (err)
+                goto free_msg;
+
+        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+
+        genlmsg_end(msg, hdr);
+
+        return genlmsg_reply(msg, info);
+
+ nla_put_failure:
+        err = -ENOBUFS;
+ free_msg:
+        nlmsg_free(msg);
+        return err;
+}
+
+static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+
+        if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
+                return -EOPNOTSUPP;
+
+        if (rdev->ap_beacons_nlpid)
+                return -EBUSY;
+
+        rdev->ap_beacons_nlpid = info->snd_pid;
+
+        return 0;
+}
+
 #define NL80211_FLAG_NEED_WIPHY         0x01
 #define NL80211_FLAG_NEED_NETDEV        0x02
 #define NL80211_FLAG_NEED_RTNL          0x04
@@ -6382,6 +6505,30 @@ static struct genl_ops nl80211_ops[] = {
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
+        {
+                .cmd = NL80211_CMD_UNEXPECTED_FRAME,
+                .doit = nl80211_register_unexpected_frame,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
+                .cmd = NL80211_CMD_PROBE_CLIENT,
+                .doit = nl80211_probe_client,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
+                .cmd = NL80211_CMD_REGISTER_BEACONS,
+                .doit = nl80211_register_beacons,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_WIPHY |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 };
 
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
@@ -6634,10 +6781,7 @@ void nl80211_send_reg_change_event(struct regulatory_request *request)
         if (wiphy_idx_valid(request->wiphy_idx))
                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         rcu_read_lock();
         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
@@ -6673,10 +6817,7 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -6757,10 +6898,7 @@ static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -6816,10 +6954,7 @@ void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
         if (resp_ie)
                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -6857,10 +6992,7 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
         if (resp_ie)
                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -6898,10 +7030,7 @@ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
         if (ie)
                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
@@ -6934,10 +7063,7 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -6972,10 +7098,7 @@ void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
         if (ie_len && ie)
                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -7014,10 +7137,7 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
         if (tsc)
                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -7068,10 +7188,7 @@ void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
                 goto nla_put_failure;
         nla_nest_end(msg, nl_freq);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         rcu_read_lock();
         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
@@ -7114,10 +7231,7 @@ static void nl80211_send_remain_on_chan_event(
         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -7188,10 +7302,7 @@ void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -7202,13 +7313,68 @@ void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
+static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
+                                       const u8 *addr, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct sk_buff *msg;
+        void *hdr;
+        int err;
+        u32 nlpid = ACCESS_ONCE(wdev->ap_unexpected_nlpid);
+
+        if (!nlpid)
+                return false;
+
+        msg = nlmsg_new(100, gfp);
+        if (!msg)
+                return true;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return true;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
+
+        err = genlmsg_end(msg, hdr);
+        if (err < 0) {
+                nlmsg_free(msg);
+                return true;
+        }
+
+        genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
+        return true;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+        return true;
+}
+
+bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
+{
+        return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
+                                          addr, gfp);
+}
+
+bool nl80211_unexpected_4addr_frame(struct net_device *dev,
+                                    const u8 *addr, gfp_t gfp)
+{
+        return __nl80211_unexpected_frame(dev,
+                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
+                                          addr, gfp);
+}
+
 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
                       struct net_device *netdev, u32 nlpid,
                       int freq, const u8 *buf, size_t len, gfp_t gfp)
 {
         struct sk_buff *msg;
         void *hdr;
-        int err;
 
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
@@ -7225,16 +7391,9 @@ int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
 
-        err = genlmsg_end(msg, hdr);
-        if (err < 0) {
-                nlmsg_free(msg);
-                return err;
-        }
+        genlmsg_end(msg, hdr);
 
-        err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
-        if (err < 0)
-                return err;
-        return 0;
+        return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
 
  nla_put_failure:
         genlmsg_cancel(msg, hdr);
@@ -7267,10 +7426,7 @@ void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
         if (ack)
                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
         return;
@@ -7312,10 +7468,7 @@ nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
 
         nla_nest_end(msg, pinfoattr);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -7357,10 +7510,7 @@ void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
 
         nla_nest_end(msg, rekey_attr);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -7403,10 +7553,7 @@ void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
 
         nla_nest_end(msg, attr);
 
-        if (genlmsg_end(msg, hdr) < 0) {
-                nlmsg_free(msg);
-                return;
-        }
+        genlmsg_end(msg, hdr);
 
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
@@ -7448,7 +7595,45 @@ nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
 
         nla_nest_end(msg, pinfoattr);
 
-        if (genlmsg_end(msg, hdr) < 0) {
+        genlmsg_end(msg, hdr);
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
+void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
+                           u64 cookie, bool acked, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct sk_buff *msg;
+        void *hdr;
+        int err;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
+        NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
+        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+        if (acked)
+                NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
+
+        err = genlmsg_end(msg, hdr);
+        if (err < 0) {
                 nlmsg_free(msg);
                 return;
         }
@@ -7461,6 +7646,45 @@ nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
         genlmsg_cancel(msg, hdr);
         nlmsg_free(msg);
 }
+EXPORT_SYMBOL(cfg80211_probe_status);
+
+void cfg80211_report_obss_beacon(struct wiphy *wiphy,
+                                 const u8 *frame, size_t len,
+                                 int freq, gfp_t gfp)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct sk_buff *msg;
+        void *hdr;
+        u32 nlpid = ACCESS_ONCE(rdev->ap_beacons_nlpid);
+
+        if (!nlpid)
+                return;
+
+        msg = nlmsg_new(len + 100, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        if (freq)
+                NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
+        NLA_PUT(msg, NL80211_ATTR_FRAME, len, frame);
+
+        genlmsg_end(msg, hdr);
+
+        genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+EXPORT_SYMBOL(cfg80211_report_obss_beacon);
 
 static int nl80211_netlink_notify(struct notifier_block * nb,
                                   unsigned long state,
@@ -7475,9 +7699,12 @@ static int nl80211_netlink_notify(struct notifier_block * nb,
 
         rcu_read_lock();
 
-        list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
+        list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
                         cfg80211_mlme_unregister_socket(wdev, notify->pid);
+                if (rdev->ap_beacons_nlpid == notify->pid)
+                        rdev->ap_beacons_nlpid = 0;
+        }
 
         rcu_read_unlock();