1 files changed, 44 insertions, 27 deletions

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index e5f92ee758f4..0c2cbbebca95 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -22,7 +22,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
 {
         struct cfg80211_scan_request *request;
         struct net_device *dev;
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
@@ -47,7 +47,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
         else
                 nl80211_send_scan_done(rdev, dev);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
         if (!request->aborted) {
                 memset(&wrqu, 0, sizeof(wrqu));
 
@@ -88,7 +88,7 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
         WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
 
         request->aborted = aborted;
-        schedule_work(&wiphy_to_dev(request->wiphy)->scan_done_wk);
+        queue_work(cfg80211_wq, &wiphy_to_dev(request->wiphy)->scan_done_wk);
 }
 EXPORT_SYMBOL(cfg80211_scan_done);
 
@@ -217,7 +217,7 @@ static bool is_mesh(struct cfg80211_bss *a,
                      a->len_information_elements);
         if (!ie)
                 return false;
-        if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
+        if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
                 return false;
 
         /*
@@ -225,7 +225,8 @@ static bool is_mesh(struct cfg80211_bss *a,
          * comparing since that may differ between stations taking
          * part in the same mesh.
          */
-        return memcmp(ie + 2, meshcfg, IEEE80211_MESH_CONFIG_LEN - 2) == 0;
+        return memcmp(ie + 2, meshcfg,
+            sizeof(struct ieee80211_meshconf_ie) - 2) == 0;
 }
 
 static int cmp_bss(struct cfg80211_bss *a,
@@ -399,7 +400,7 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                   res->pub.information_elements,
                                   res->pub.len_information_elements);
                 if (!meshid || !meshcfg ||
-                    meshcfg[1] != IEEE80211_MESH_CONFIG_LEN) {
+                    meshcfg[1] != sizeof(struct ieee80211_meshconf_ie)) {
                         /* bogus mesh */
                         kref_put(&res->ref, bss_release);
                         return NULL;
@@ -592,7 +593,7 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 }
 EXPORT_SYMBOL(cfg80211_unlink_bss);
 
-#ifdef CONFIG_WIRELESS_EXT
+#ifdef CONFIG_CFG80211_WEXT
 int cfg80211_wext_siwscan(struct net_device *dev,
                           struct iw_request_info *info,
                           union iwreq_data *wrqu, char *extra)
@@ -600,7 +601,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         struct cfg80211_registered_device *rdev;
         struct wiphy *wiphy;
         struct iw_scan_req *wreq = NULL;
-        struct cfg80211_scan_request *creq;
+        struct cfg80211_scan_request *creq = NULL;
         int i, err, n_channels = 0;
         enum ieee80211_band band;
 
@@ -650,9 +651,15 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         i = 0;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 int j;
+
                 if (!wiphy->bands[band])
                         continue;
+
                 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
+                        /* ignore disabled channels */
+                        if (wiphy->bands[band]->channels[j].flags &
+                                                IEEE80211_CHAN_DISABLED)
+                                continue;
 
                         /* If we have a wireless request structure and the
                          * wireless request specifies frequencies, then search
@@ -687,8 +694,10 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         /* translate "Scan for SSID" request */
         if (wreq) {
                 if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
-                        if (wreq->essid_len > IEEE80211_MAX_SSID_LEN)
-                                return -EINVAL;
+                        if (wreq->essid_len > IEEE80211_MAX_SSID_LEN) {
+                                err = -EINVAL;
+                                goto out;
+                        }
                         memcpy(creq->ssids[0].ssid, wreq->essid, wreq->essid_len);
                         creq->ssids[0].ssid_len = wreq->essid_len;
                 }
@@ -700,12 +709,15 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         err = rdev->ops->scan(wiphy, dev, creq);
         if (err) {
                 rdev->scan_req = NULL;
-                kfree(creq);
+                /* creq will be freed below */
         } else {
                 nl80211_send_scan_start(rdev, dev);
+                /* creq now owned by driver */
+                creq = NULL;
                 dev_hold(dev);
         }
  out:
+        kfree(creq);
         cfg80211_unlock_rdev(rdev);
         return err;
 }
@@ -859,7 +871,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                         break;
                 case WLAN_EID_MESH_CONFIG:
                         ismesh = true;
-                        if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
+                        if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
                                 break;
                         buf = kmalloc(50, GFP_ATOMIC);
                         if (!buf)
@@ -867,35 +879,40 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                         cfg = ie + 2;
                         memset(&iwe, 0, sizeof(iwe));
                         iwe.cmd = IWEVCUSTOM;
-                        sprintf(buf, "Mesh network (version %d)", cfg[0]);
+                        sprintf(buf, "Mesh Network Path Selection Protocol ID: "
+                                "0x%02X", cfg[0]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Path Selection Metric ID: 0x%02X",
+                                cfg[1]);
+                        iwe.u.data.length = strlen(buf);
+                        current_ev = iwe_stream_add_point(info, current_ev,
+                                                          end_buf,
+                                                          &iwe, buf);
+                        sprintf(buf, "Congestion Control Mode ID: 0x%02X",
+                                cfg[2]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
                                                           &iwe, buf);
-                        sprintf(buf, "Path Selection Protocol ID: "
-                                "0x%02X%02X%02X%02X", cfg[1], cfg[2], cfg[3],
-                                                        cfg[4]);
+                        sprintf(buf, "Synchronization ID: 0x%02X", cfg[3]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
                                                           &iwe, buf);
-                        sprintf(buf, "Path Selection Metric ID: "
-                                "0x%02X%02X%02X%02X", cfg[5], cfg[6], cfg[7],
-                                                        cfg[8]);
+                        sprintf(buf, "Authentication ID: 0x%02X", cfg[4]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
                                                           &iwe, buf);
-                        sprintf(buf, "Congestion Control Mode ID: "
-                                "0x%02X%02X%02X%02X", cfg[9], cfg[10],
-                                                        cfg[11], cfg[12]);
+                        sprintf(buf, "Formation Info: 0x%02X", cfg[5]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
                                                           &iwe, buf);
-                        sprintf(buf, "Channel Precedence: "
-                                "0x%02X%02X%02X%02X", cfg[13], cfg[14],
-                                                        cfg[15], cfg[16]);
+                        sprintf(buf, "Capabilities: 0x%02X", cfg[6]);
                         iwe.u.data.length = strlen(buf);
                         current_ev = iwe_stream_add_point(info, current_ev,
                                                           end_buf,
@@ -925,8 +942,8 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                 ie += ie[1] + 2;
         }
 
-        if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS)
-            || ismesh) {
+        if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
+            ismesh) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = SIOCGIWMODE;
                 if (ismesh)