1 files changed, 20 insertions, 7 deletions

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 98fa8eb6cc4b..cea338150d05 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3461,9 +3461,6 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
 
-        if (rdev->sched_scan_req)
-                return -EINPROGRESS;
-
         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
                 return -EINVAL;
 
@@ -3502,12 +3499,21 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
         if (ie_len > wiphy->max_scan_ie_len)
                 return -EINVAL;
 
+        mutex_lock(&rdev->sched_scan_mtx);
+
+        if (rdev->sched_scan_req) {
+                err = -EINPROGRESS;
+                goto out;
+        }
+
         request = kzalloc(sizeof(*request)
                         + sizeof(*request->ssids) * n_ssids
                         + sizeof(*request->channels) * n_channels
                         + ie_len, GFP_KERNEL);
-        if (!request)
-                return -ENOMEM;
+        if (!request) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         if (n_ssids)
                 request->ssids = (void *)&request->channels[n_channels];
@@ -3605,6 +3611,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
 out_free:
         kfree(request);
 out:
+        mutex_unlock(&rdev->sched_scan_mtx);
         return err;
 }
 
@@ -3612,12 +3619,17 @@ static int nl80211_stop_sched_scan(struct sk_buff *skb,
                                    struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        int err;
 
         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
             !rdev->ops->sched_scan_stop)
                 return -EOPNOTSUPP;
 
-        return __cfg80211_stop_sched_scan(rdev, false);
+        mutex_lock(&rdev->sched_scan_mtx);
+        err = __cfg80211_stop_sched_scan(rdev, false);
+        mutex_unlock(&rdev->sched_scan_mtx);
+
+        return err;
 }
 
 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
@@ -6463,7 +6475,8 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
         if (addr)
                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
-        NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
+        if (key_id != -1)
+                NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
         if (tsc)
                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);