1 files changed, 27 insertions, 30 deletions

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index d4397eba5408..d1ed4aebbbb7 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -161,18 +161,25 @@ static void __cfg80211_bss_expire(struct cfg80211_registered_device *dev,
                 dev->bss_generation++;
 }
 
-void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
+void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
+                           bool send_message)
 {
         struct cfg80211_scan_request *request;
         struct wireless_dev *wdev;
+        struct sk_buff *msg;
 #ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
 #endif
 
         ASSERT_RTNL();
 
-        request = rdev->scan_req;
+        if (rdev->scan_msg) {
+                nl80211_send_scan_result(rdev, rdev->scan_msg);
+                rdev->scan_msg = NULL;
+                return;
+        }
 
+        request = rdev->scan_req;
         if (!request)
                 return;
 
@@ -186,18 +193,16 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
         if (wdev->netdev)
                 cfg80211_sme_scan_done(wdev->netdev);
 
-        if (request->aborted) {
-                nl80211_send_scan_aborted(rdev, wdev);
-        } else {
-                if (request->flags & NL80211_SCAN_FLAG_FLUSH) {
-                        /* flush entries from previous scans */
-                        spin_lock_bh(&rdev->bss_lock);
-                        __cfg80211_bss_expire(rdev, request->scan_start);
-                        spin_unlock_bh(&rdev->bss_lock);
-                }
-                nl80211_send_scan_done(rdev, wdev);
+        if (!request->aborted &&
+            request->flags & NL80211_SCAN_FLAG_FLUSH) {
+                /* flush entries from previous scans */
+                spin_lock_bh(&rdev->bss_lock);
+                __cfg80211_bss_expire(rdev, request->scan_start);
+                spin_unlock_bh(&rdev->bss_lock);
         }
 
+        msg = nl80211_build_scan_msg(rdev, wdev, request->aborted);
+
 #ifdef CONFIG_CFG80211_WEXT
         if (wdev->netdev && !request->aborted) {
                 memset(&wrqu, 0, sizeof(wrqu));
@@ -210,17 +215,12 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
                 dev_put(wdev->netdev);
 
         rdev->scan_req = NULL;
+        kfree(request);
 
-        /*
-         * OK. If this is invoked with "leak" then we can't
-         * free this ... but we've cleaned it up anyway. The
-         * driver failed to call the scan_done callback, so
-         * all bets are off, it might still be trying to use
-         * the scan request or not ... if it accesses the dev
-         * in there (it shouldn't anyway) then it may crash.
-         */
-        if (!leak)
-                kfree(request);
+        if (!send_message)
+                rdev->scan_msg = msg;
+        else
+                nl80211_send_scan_result(rdev, msg);
 }
 
 void __cfg80211_scan_done(struct work_struct *wk)
@@ -231,7 +231,7 @@ void __cfg80211_scan_done(struct work_struct *wk)
                             scan_done_wk);
 
         rtnl_lock();
-        ___cfg80211_scan_done(rdev, false);
+        ___cfg80211_scan_done(rdev, true);
         rtnl_unlock();
 }
 
@@ -1089,7 +1089,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
-        if (rdev->scan_req) {
+        if (rdev->scan_req || rdev->scan_msg) {
                 err = -EBUSY;
                 goto out;
         }
@@ -1099,11 +1099,8 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         /* Determine number of channels, needed to allocate creq */
         if (wreq && wreq->num_channels)
                 n_channels = wreq->num_channels;
-        else {
-                for (band = 0; band < IEEE80211_NUM_BANDS; band++)
-                        if (wiphy->bands[band])
-                                n_channels += wiphy->bands[band]->n_channels;
-        }
+        else
+                n_channels = ieee80211_get_num_supported_channels(wiphy);
 
         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
                        n_channels * sizeof(void *),
@@ -1494,7 +1491,7 @@ int cfg80211_wext_giwscan(struct net_device *dev,
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
-        if (rdev->scan_req)
+        if (rdev->scan_req || rdev->scan_msg)
                 return -EAGAIN;
 
         res = ieee80211_scan_results(rdev, info, extra, data->length);