1 files changed, 335 insertions, 295 deletions

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 45f1618c8e23..674aadca0079 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -19,55 +19,142 @@
 #include "wext-compat.h"
 #include "rdev-ops.h"
 
+/**
+ * DOC: BSS tree/list structure
+ *
+ * At the top level, the BSS list is kept in both a list in each
+ * registered device (@bss_list) as well as an RB-tree for faster
+ * lookup. In the RB-tree, entries can be looked up using their
+ * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
+ * for other BSSes.
+ *
+ * Due to the possibility of hidden SSIDs, there's a second level
+ * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
+ * The hidden_list connects all BSSes belonging to a single AP
+ * that has a hidden SSID, and connects beacon and probe response
+ * entries. For a probe response entry for a hidden SSID, the
+ * hidden_beacon_bss pointer points to the BSS struct holding the
+ * beacon's information.
+ *
+ * Reference counting is done for all these references except for
+ * the hidden_list, so that a beacon BSS struct that is otherwise
+ * not referenced has one reference for being on the bss_list and
+ * one for each probe response entry that points to it using the
+ * hidden_beacon_bss pointer. When a BSS struct that has such a
+ * pointer is get/put, the refcount update is also propagated to
+ * the referenced struct, this ensure that it cannot get removed
+ * while somebody is using the probe response version.
+ *
+ * Note that the hidden_beacon_bss pointer never changes, due to
+ * the reference counting. Therefore, no locking is needed for
+ * it.
+ *
+ * Also note that the hidden_beacon_bss pointer is only relevant
+ * if the driver uses something other than the IEs, e.g. private
+ * data stored stored in the BSS struct, since the beacon IEs are
+ * also linked into the probe response struct.
+ */
+
 #define IEEE80211_SCAN_RESULT_EXPIRE    (30 * HZ)
 
-static void bss_release(struct kref *ref)
+static void bss_free(struct cfg80211_internal_bss *bss)
 {
         struct cfg80211_bss_ies *ies;
-        struct cfg80211_internal_bss *bss;
-
-        bss = container_of(ref, struct cfg80211_internal_bss, ref);
 
         if (WARN_ON(atomic_read(&bss->hold)))
                 return;
 
-        if (bss->pub.free_priv)
-                bss->pub.free_priv(&bss->pub);
-
         ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
-        if (ies)
+        if (ies && !bss->pub.hidden_beacon_bss)
                 kfree_rcu(ies, rcu_head);
         ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
         if (ies)
                 kfree_rcu(ies, rcu_head);
 
+        /*
+         * This happens when the module is removed, it doesn't
+         * really matter any more save for completeness
+         */
+        if (!list_empty(&bss->hidden_list))
+                list_del(&bss->hidden_list);
+
         kfree(bss);
 }
 
-/* must hold dev->bss_lock! */
-static void __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
+static inline void bss_ref_get(struct cfg80211_registered_device *dev,
+                               struct cfg80211_internal_bss *bss)
+{
+        lockdep_assert_held(&dev->bss_lock);
+
+        bss->refcount++;
+        if (bss->pub.hidden_beacon_bss) {
+                bss = container_of(bss->pub.hidden_beacon_bss,
+                                   struct cfg80211_internal_bss,
+                                   pub);
+                bss->refcount++;
+        }
+}
+
+static inline void bss_ref_put(struct cfg80211_registered_device *dev,
+                               struct cfg80211_internal_bss *bss)
+{
+        lockdep_assert_held(&dev->bss_lock);
+
+        if (bss->pub.hidden_beacon_bss) {
+                struct cfg80211_internal_bss *hbss;
+                hbss = container_of(bss->pub.hidden_beacon_bss,
+                                    struct cfg80211_internal_bss,
+                                    pub);
+                hbss->refcount--;
+                if (hbss->refcount == 0)
+                        bss_free(hbss);
+        }
+        bss->refcount--;
+        if (bss->refcount == 0)
+                bss_free(bss);
+}
+
+static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
                                   struct cfg80211_internal_bss *bss)
 {
+        lockdep_assert_held(&dev->bss_lock);
+
+        if (!list_empty(&bss->hidden_list)) {
+                /*
+                 * don't remove the beacon entry if it has
+                 * probe responses associated with it
+                 */
+                if (!bss->pub.hidden_beacon_bss)
+                        return false;
+                /*
+                 * if it's a probe response entry break its
+                 * link to the other entries in the group
+                 */
+                list_del_init(&bss->hidden_list);
+        }
+
         list_del_init(&bss->list);
         rb_erase(&bss->rbn, &dev->bss_tree);
-        kref_put(&bss->ref, bss_release);
+        bss_ref_put(dev, bss);
+        return true;
 }
 
-/* must hold dev->bss_lock! */
 static void __cfg80211_bss_expire(struct cfg80211_registered_device *dev,
                                   unsigned long expire_time)
 {
         struct cfg80211_internal_bss *bss, *tmp;
         bool expired = false;
 
+        lockdep_assert_held(&dev->bss_lock);
+
         list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
                 if (atomic_read(&bss->hold))
                         continue;
                 if (!time_after(expire_time, bss->ts))
                         continue;
 
-                __cfg80211_unlink_bss(dev, bss);
-                expired = true;
+                if (__cfg80211_unlink_bss(dev, bss))
+                        expired = true;
         }
 
         if (expired)
@@ -234,15 +321,16 @@ int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
         return 0;
 }
 
-/* must hold dev->bss_lock! */
 void cfg80211_bss_age(struct cfg80211_registered_device *dev,
                       unsigned long age_secs)
 {
         struct cfg80211_internal_bss *bss;
         unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
 
+        spin_lock_bh(&dev->bss_lock);
         list_for_each_entry(bss, &dev->bss_list, list)
                 bss->ts -= age_jiffies;
+        spin_unlock_bh(&dev->bss_lock);
 }
 
 void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
@@ -277,40 +365,24 @@ const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
                 if (!pos)
                         return NULL;
 
-                if (end - pos < sizeof(*ie))
-                        return NULL;
-
                 ie = (struct ieee80211_vendor_ie *)pos;
+
+                /* make sure we can access ie->len */
+                BUILD_BUG_ON(offsetof(struct ieee80211_vendor_ie, len) != 1);
+
+                if (ie->len < sizeof(*ie))
+                        goto cont;
+
                 ie_oui = ie->oui[0] << 16 | ie->oui[1] << 8 | ie->oui[2];
                 if (ie_oui == oui && ie->oui_type == oui_type)
                         return pos;
-
+cont:
                 pos += 2 + ie->len;
         }
         return NULL;
 }
 EXPORT_SYMBOL(cfg80211_find_vendor_ie);
 
-static int cmp_ies(u8 num, const u8 *ies1, int len1, const u8 *ies2, int len2)
-{
-        const u8 *ie1 = cfg80211_find_ie(num, ies1, len1);
-        const u8 *ie2 = cfg80211_find_ie(num, ies2, len2);
-
-        /* equal if both missing */
-        if (!ie1 && !ie2)
-                return 0;
-        /* sort missing IE before (left of) present IE */
-        if (!ie1)
-                return -1;
-        if (!ie2)
-                return 1;
-
-        /* sort by length first, then by contents */
-        if (ie1[1] != ie2[1])
-                return ie2[1] - ie1[1];
-        return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
-}
-
 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
                    const u8 *ssid, size_t ssid_len)
 {
@@ -334,109 +406,30 @@ static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
         return memcmp(ssidie + 2, ssid, ssid_len) == 0;
 }
 
-static bool is_mesh_bss(struct cfg80211_bss *a)
-{
-        const struct cfg80211_bss_ies *ies;
-        const u8 *ie;
-
-        if (!WLAN_CAPABILITY_IS_STA_BSS(a->capability))
-                return false;
-
-        ies = rcu_access_pointer(a->ies);
-        if (!ies)
-                return false;
-
-        ie = cfg80211_find_ie(WLAN_EID_MESH_ID, ies->data, ies->len);
-        if (!ie)
-                return false;
-
-        ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, ies->data, ies->len);
-        if (!ie)
-                return false;
-
-        return true;
-}
-
-static bool is_mesh(struct cfg80211_bss *a,
-                    const u8 *meshid, size_t meshidlen,
-                    const u8 *meshcfg)
-{
-        const struct cfg80211_bss_ies *ies;
-        const u8 *ie;
-
-        if (!WLAN_CAPABILITY_IS_STA_BSS(a->capability))
-                return false;
-
-        ies = rcu_access_pointer(a->ies);
-        if (!ies)
-                return false;
-
-        ie = cfg80211_find_ie(WLAN_EID_MESH_ID, ies->data, ies->len);
-        if (!ie)
-                return false;
-        if (ie[1] != meshidlen)
-                return false;
-        if (memcmp(ie + 2, meshid, meshidlen))
-                return false;
-
-        ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, ies->data, ies->len);
-        if (!ie)
-                return false;
-        if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
-                return false;
-
-        /*
-         * Ignore mesh capability (last two bytes of the IE) when
-         * comparing since that may differ between stations taking
-         * part in the same mesh.
-         */
-        return memcmp(ie + 2, meshcfg,
-                      sizeof(struct ieee80211_meshconf_ie) - 2) == 0;
-}
+/**
+ * enum bss_compare_mode - BSS compare mode
+ * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
+ * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
+ * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
+ */
+enum bss_compare_mode {
+        BSS_CMP_REGULAR,
+        BSS_CMP_HIDE_ZLEN,
+        BSS_CMP_HIDE_NUL,
+};
 
-static int cmp_bss_core(struct cfg80211_bss *a, struct cfg80211_bss *b)
+static int cmp_bss(struct cfg80211_bss *a,
+                   struct cfg80211_bss *b,
+                   enum bss_compare_mode mode)
 {
         const struct cfg80211_bss_ies *a_ies, *b_ies;
-        int r;
+        const u8 *ie1 = NULL;
+        const u8 *ie2 = NULL;
+        int i, r;
 
         if (a->channel != b->channel)
                 return b->channel->center_freq - a->channel->center_freq;
 
-        if (is_mesh_bss(a) && is_mesh_bss(b)) {
-                a_ies = rcu_access_pointer(a->ies);
-                if (!a_ies)
-                        return -1;
-                b_ies = rcu_access_pointer(b->ies);
-                if (!b_ies)
-                        return 1;
-
-                r = cmp_ies(WLAN_EID_MESH_ID,
-                            a_ies->data, a_ies->len,
-                            b_ies->data, b_ies->len);
-                if (r)
-                        return r;
-                return cmp_ies(WLAN_EID_MESH_CONFIG,
-                               a_ies->data, a_ies->len,
-                               b_ies->data, b_ies->len);
-        }
-
-        /*
-         * we can't use compare_ether_addr here since we need a < > operator.
-         * The binary return value of compare_ether_addr isn't enough
-         */
-        return memcmp(a->bssid, b->bssid, sizeof(a->bssid));
-}
-
-static int cmp_bss(struct cfg80211_bss *a,
-                   struct cfg80211_bss *b)
-{
-        const struct cfg80211_bss_ies *a_ies, *b_ies;
-        int r;
-
-        r = cmp_bss_core(a, b);
-        if (r)
-                return r;
-
         a_ies = rcu_access_pointer(a->ies);
         if (!a_ies)
                 return -1;
@@ -444,42 +437,51 @@ static int cmp_bss(struct cfg80211_bss *a,
         if (!b_ies)
                 return 1;
 
-        return cmp_ies(WLAN_EID_SSID,
-                       a_ies->data, a_ies->len,
-                       b_ies->data, b_ies->len);
-}
-
-static int cmp_hidden_bss(struct cfg80211_bss *a, struct cfg80211_bss *b)
-{
-        const struct cfg80211_bss_ies *a_ies, *b_ies;
-        const u8 *ie1;
-        const u8 *ie2;
-        int i;
-        int r;
+        if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
+                ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
+                                       a_ies->data, a_ies->len);
+        if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
+                ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
+                                       b_ies->data, b_ies->len);
+        if (ie1 && ie2) {
+                int mesh_id_cmp;
+
+                if (ie1[1] == ie2[1])
+                        mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
+                else
+                        mesh_id_cmp = ie2[1] - ie1[1];
+
+                ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
+                                       a_ies->data, a_ies->len);
+                ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
+                                       b_ies->data, b_ies->len);
+                if (ie1 && ie2) {
+                        if (mesh_id_cmp)
+                                return mesh_id_cmp;
+                        if (ie1[1] != ie2[1])
+                                return ie2[1] - ie1[1];
+                        return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
+                }
+        }
 
-        r = cmp_bss_core(a, b);
+        /*
+         * we can't use compare_ether_addr here since we need a < > operator.
+         * The binary return value of compare_ether_addr isn't enough
+         */
+        r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
         if (r)
                 return r;
 
-        a_ies = rcu_access_pointer(a->ies);
-        if (!a_ies)
-                return -1;
-        b_ies = rcu_access_pointer(b->ies);
-        if (!b_ies)
-                return 1;
-
         ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
         ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
 
+        if (!ie1 && !ie2)
+                return 0;
+
         /*
-         * Key comparator must use same algorithm in any rb-tree
-         * search function (order is important), otherwise ordering
-         * of items in the tree is broken and search gives incorrect
-         * results. This code uses same order as cmp_ies() does.
-         *
-         * Note that due to the differring behaviour with hidden SSIDs
-         * this function only works when "b" is the tree element and
-         * "a" is the key we're looking for.
+         * Note that with "hide_ssid", the function returns a match if
+         * the already-present BSS ("b") is a hidden SSID beacon for
+         * the new BSS ("a").
          */
 
         /* sort missing IE before (left of) present IE */
@@ -488,24 +490,36 @@ static int cmp_hidden_bss(struct cfg80211_bss *a, struct cfg80211_bss *b)
         if (!ie2)
                 return 1;
 
-        /* zero-size SSID is used as an indication of the hidden bss */
-        if (!ie2[1])
+        switch (mode) {
+        case BSS_CMP_HIDE_ZLEN:
+                /*
+                 * In ZLEN mode we assume the BSS entry we're
+                 * looking for has a zero-length SSID. So if
+                 * the one we're looking at right now has that,
+                 * return 0. Otherwise, return the difference
+                 * in length, but since we're looking for the
+                 * 0-length it's really equivalent to returning
+                 * the length of the one we're looking at.
+                 *
+                 * No content comparison is needed as we assume
+                 * the content length is zero.
+                 */
+                return ie2[1];
+        case BSS_CMP_REGULAR:
+        default:
+                /* sort by length first, then by contents */
+                if (ie1[1] != ie2[1])
+                        return ie2[1] - ie1[1];
+                return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
+        case BSS_CMP_HIDE_NUL:
+                if (ie1[1] != ie2[1])
+                        return ie2[1] - ie1[1];
+                /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
+                for (i = 0; i < ie2[1]; i++)
+                        if (ie2[i + 2])
+                                return -1;
                 return 0;
-
-        /* sort by length first, then by contents */
-        if (ie1[1] != ie2[1])
-                return ie2[1] - ie1[1];
-
-        /*
-         * zeroed SSID ie is another indication of a hidden bss;
-         * if it isn't zeroed just return the regular sort value
-         * to find the next candidate
-         */
-        for (i = 0; i < ie2[1]; i++)
-                if (ie2[i + 2])
-                        return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
-
-        return 0;
+        }
 }
 
 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
@@ -534,7 +548,7 @@ struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
                         continue;
                 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
                         res = bss;
-                        kref_get(&res->ref);
+                        bss_ref_get(dev, res);
                         break;
                 }
         }
@@ -547,34 +561,6 @@ struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_get_bss);
 
-struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
-                                       struct ieee80211_channel *channel,
-                                       const u8 *meshid, size_t meshidlen,
-                                       const u8 *meshcfg)
-{
-        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
-        struct cfg80211_internal_bss *bss, *res = NULL;
-
-        spin_lock_bh(&dev->bss_lock);
-
-        list_for_each_entry(bss, &dev->bss_list, list) {
-                if (channel && bss->pub.channel != channel)
-                        continue;
-                if (is_mesh(&bss->pub, meshid, meshidlen, meshcfg)) {
-                        res = bss;
-                        kref_get(&res->ref);
-                        break;
-                }
-        }
-
-        spin_unlock_bh(&dev->bss_lock);
-        if (!res)
-                return NULL;
-        return &res->pub;
-}
-EXPORT_SYMBOL(cfg80211_get_mesh);
-
-
 static void rb_insert_bss(struct cfg80211_registered_device *dev,
                           struct cfg80211_internal_bss *bss)
 {
@@ -587,7 +573,7 @@ static void rb_insert_bss(struct cfg80211_registered_device *dev,
                 parent = *p;
                 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
 
-                cmp = cmp_bss(&bss->pub, &tbss->pub);
+                cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
 
                 if (WARN_ON(!cmp)) {
                         /* will sort of leak this BSS */
@@ -606,7 +592,8 @@ static void rb_insert_bss(struct cfg80211_registered_device *dev,
 
 static struct cfg80211_internal_bss *
 rb_find_bss(struct cfg80211_registered_device *dev,
-            struct cfg80211_internal_bss *res)
+            struct cfg80211_internal_bss *res,
+            enum bss_compare_mode mode)
 {
         struct rb_node *n = dev->bss_tree.rb_node;
         struct cfg80211_internal_bss *bss;
@@ -614,7 +601,7 @@ rb_find_bss(struct cfg80211_registered_device *dev,
 
         while (n) {
                 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
-                r = cmp_bss(&res->pub, &bss->pub);
+                r = cmp_bss(&res->pub, &bss->pub, mode);
 
                 if (r == 0)
                         return bss;
@@ -627,46 +614,67 @@ rb_find_bss(struct cfg80211_registered_device *dev,
         return NULL;
 }
 
-static struct cfg80211_internal_bss *
-rb_find_hidden_bss(struct cfg80211_registered_device *dev,
-                   struct cfg80211_internal_bss *res)
+static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
+                                   struct cfg80211_internal_bss *new)
 {
-        struct rb_node *n = dev->bss_tree.rb_node;
+        const struct cfg80211_bss_ies *ies;
         struct cfg80211_internal_bss *bss;
-        int r;
+        const u8 *ie;
+        int i, ssidlen;
+        u8 fold = 0;
 
-        while (n) {
-                bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
-                r = cmp_hidden_bss(&res->pub, &bss->pub);
+        ies = rcu_access_pointer(new->pub.beacon_ies);
+        if (WARN_ON(!ies))
+                return false;
 
-                if (r == 0)
-                        return bss;
-                else if (r < 0)
-                        n = n->rb_left;
-                else
-                        n = n->rb_right;
+        ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
+        if (!ie) {
+                /* nothing to do */
+                return true;
         }
 
-        return NULL;
-}
+        ssidlen = ie[1];
+        for (i = 0; i < ssidlen; i++)
+                fold |= ie[2 + i];
 
-static void
-copy_hidden_ies(struct cfg80211_internal_bss *res,
-                struct cfg80211_internal_bss *hidden)
-{
-        const struct cfg80211_bss_ies *ies;
+        if (fold) {
+                /* not a hidden SSID */
+                return true;
+        }
 
-        if (rcu_access_pointer(res->pub.beacon_ies))
-                return;
+        /* This is the bad part ... */
 
-        ies = rcu_access_pointer(hidden->pub.beacon_ies);
-        if (WARN_ON(!ies))
-                return;
+        list_for_each_entry(bss, &dev->bss_list, list) {
+                if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
+                        continue;
+                if (bss->pub.channel != new->pub.channel)
+                        continue;
+                if (rcu_access_pointer(bss->pub.beacon_ies))
+                        continue;
+                ies = rcu_access_pointer(bss->pub.ies);
+                if (!ies)
+                        continue;
+                ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
+                if (!ie)
+                        continue;
+                if (ssidlen && ie[1] != ssidlen)
+                        continue;
+                /* that would be odd ... */
+                if (bss->pub.beacon_ies)
+                        continue;
+                if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
+                        continue;
+                if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
+                        list_del(&bss->hidden_list);
+                /* combine them */
+                list_add(&bss->hidden_list, &new->hidden_list);
+                bss->pub.hidden_beacon_bss = &new->pub;
+                new->refcount += bss->refcount;
+                rcu_assign_pointer(bss->pub.beacon_ies,
+                                   new->pub.beacon_ies);
+        }
 
-        ies = kmemdup(ies, sizeof(*ies) + ies->len, GFP_ATOMIC);
-        if (unlikely(!ies))
-                return;
-        rcu_assign_pointer(res->pub.beacon_ies, ies);
+        return true;
 }
 
 static struct cfg80211_internal_bss *
@@ -687,11 +695,10 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 return NULL;
         }
 
-        found = rb_find_bss(dev, tmp);
+        found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR);
 
         if (found) {
                 found->pub.beacon_interval = tmp->pub.beacon_interval;
-                found->pub.tsf = tmp->pub.tsf;
                 found->pub.signal = tmp->pub.signal;
                 found->pub.capability = tmp->pub.capability;
                 found->ts = tmp->ts;
@@ -711,19 +718,45 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                 kfree_rcu((struct cfg80211_bss_ies *)old,
                                           rcu_head);
                 } else if (rcu_access_pointer(tmp->pub.beacon_ies)) {
-                        const struct cfg80211_bss_ies *old, *ies;
+                        const struct cfg80211_bss_ies *old;
+                        struct cfg80211_internal_bss *bss;
+
+                        if (found->pub.hidden_beacon_bss &&
+                            !list_empty(&found->hidden_list)) {
+                                /*
+                                 * The found BSS struct is one of the probe
+                                 * response members of a group, but we're
+                                 * receiving a beacon (beacon_ies in the tmp
+                                 * bss is used). This can only mean that the
+                                 * AP changed its beacon from not having an
+                                 * SSID to showing it, which is confusing so
+                                 * drop this information.
+                                 */
+                                goto drop;
+                        }
 
                         old = rcu_access_pointer(found->pub.beacon_ies);
-                        ies = rcu_access_pointer(found->pub.ies);
 
                         rcu_assign_pointer(found->pub.beacon_ies,
                                            tmp->pub.beacon_ies);
 
                         /* Override IEs if they were from a beacon before */
-                        if (old == ies)
+                        if (old == rcu_access_pointer(found->pub.ies))
                                 rcu_assign_pointer(found->pub.ies,
                                                    tmp->pub.beacon_ies);
 
+                        /* Assign beacon IEs to all sub entries */
+                        list_for_each_entry(bss, &found->hidden_list,
+                                            hidden_list) {
+                                const struct cfg80211_bss_ies *ies;
+
+                                ies = rcu_access_pointer(bss->pub.beacon_ies);
+                                WARN_ON(ies != old);
+
+                                rcu_assign_pointer(bss->pub.beacon_ies,
+                                                   tmp->pub.beacon_ies);
+                        }
+
                         if (old)
                                 kfree_rcu((struct cfg80211_bss_ies *)old,
                                           rcu_head);
@@ -733,19 +766,6 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 struct cfg80211_internal_bss *hidden;
                 struct cfg80211_bss_ies *ies;
 
-                /* First check if the beacon is a probe response from
-                 * a hidden bss. If so, copy beacon ies (with nullified
-                 * ssid) into the probe response bss entry (with real ssid).
-                 * It is required basically for PSM implementation
-                 * (probe responses do not contain tim ie) */
-
-                /* TODO: The code is not trying to update existing probe
-                 * response bss entries when beacon ies are
-                 * getting changed. */
-                hidden = rb_find_hidden_bss(dev, tmp);
-                if (hidden)
-                        copy_hidden_ies(tmp, hidden);
-
                 /*
                  * create a copy -- the "res" variable that is passed in
                  * is allocated on the stack since it's not needed in the
@@ -760,21 +780,51 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                         ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
                         if (ies)
                                 kfree_rcu(ies, rcu_head);
-                        spin_unlock_bh(&dev->bss_lock);
-                        return NULL;
+                        goto drop;
                 }
                 memcpy(new, tmp, sizeof(*new));
-                kref_init(&new->ref);
+                new->refcount = 1;
+                INIT_LIST_HEAD(&new->hidden_list);
+
+                if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
+                        hidden = rb_find_bss(dev, tmp, BSS_CMP_HIDE_ZLEN);
+                        if (!hidden)
+                                hidden = rb_find_bss(dev, tmp,
+                                                     BSS_CMP_HIDE_NUL);
+                        if (hidden) {
+                                new->pub.hidden_beacon_bss = &hidden->pub;
+                                list_add(&new->hidden_list,
+                                         &hidden->hidden_list);
+                                hidden->refcount++;
+                                rcu_assign_pointer(new->pub.beacon_ies,
+                                                   hidden->pub.beacon_ies);
+                        }
+                } else {
+                        /*
+                         * Ok so we found a beacon, and don't have an entry. If
+                         * it's a beacon with hidden SSID, we might be in for an
+                         * expensive search for any probe responses that should
+                         * be grouped with this beacon for updates ...
+                         */
+                        if (!cfg80211_combine_bsses(dev, new)) {
+                                kfree(new);
+                                goto drop;
+                        }
+                }
+
                 list_add_tail(&new->list, &dev->bss_list);
                 rb_insert_bss(dev, new);
                 found = new;
         }
 
         dev->bss_generation++;
+        bss_ref_get(dev, found);
         spin_unlock_bh(&dev->bss_lock);
 
-        kref_get(&found->ref);
         return found;
+ drop:
+        spin_unlock_bh(&dev->bss_lock);
+        return NULL;
 }
 
 static struct ieee80211_channel *
@@ -833,7 +883,6 @@ cfg80211_inform_bss(struct wiphy *wiphy,
         memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
         tmp.pub.channel = channel;
         tmp.pub.signal = signal;
-        tmp.pub.tsf = tsf;
         tmp.pub.beacon_interval = beacon_interval;
         tmp.pub.capability = capability;
         /*
@@ -841,16 +890,14 @@ cfg80211_inform_bss(struct wiphy *wiphy,
          * Response frame, we need to pick one of the options and only use it
          * with the driver that does not provide the full Beacon/Probe Response
          * frame. Use Beacon frame pointer to avoid indicating that this should
-         * override the iies pointer should we have received an earlier
+         * override the IEs pointer should we have received an earlier
          * indication of Probe Response data.
-         *
-         * The initial buffer for the IEs is allocated with the BSS entry and
-         * is located after the private area.
          */
         ies = kmalloc(sizeof(*ies) + ielen, gfp);
         if (!ies)
                 return NULL;
         ies->len = ielen;
+        ies->tsf = tsf;
         memcpy(ies->data, ie, ielen);
 
         rcu_assign_pointer(tmp.pub.beacon_ies, ies);
@@ -907,6 +954,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         if (!ies)
                 return NULL;
         ies->len = ielen;
+        ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
         memcpy(ies->data, mgmt->u.probe_resp.variable, ielen);
 
         if (ieee80211_is_probe_resp(mgmt->frame_control))
@@ -918,7 +966,6 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN);
         tmp.pub.channel = channel;
         tmp.pub.signal = signal;
-        tmp.pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
         tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
         tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
 
@@ -935,27 +982,35 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_inform_bss_frame);
 
-void cfg80211_ref_bss(struct cfg80211_bss *pub)
+void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 {
+        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
         struct cfg80211_internal_bss *bss;
 
         if (!pub)
                 return;
 
         bss = container_of(pub, struct cfg80211_internal_bss, pub);
-        kref_get(&bss->ref);
+
+        spin_lock_bh(&dev->bss_lock);
+        bss_ref_get(dev, bss);
+        spin_unlock_bh(&dev->bss_lock);
 }
 EXPORT_SYMBOL(cfg80211_ref_bss);
 
-void cfg80211_put_bss(struct cfg80211_bss *pub)
+void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 {
+        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
         struct cfg80211_internal_bss *bss;
 
         if (!pub)
                 return;
 
         bss = container_of(pub, struct cfg80211_internal_bss, pub);
-        kref_put(&bss->ref, bss_release);
+
+        spin_lock_bh(&dev->bss_lock);
+        bss_ref_put(dev, bss);
+        spin_unlock_bh(&dev->bss_lock);
 }
 EXPORT_SYMBOL(cfg80211_put_bss);
 
@@ -971,8 +1026,8 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 
         spin_lock_bh(&dev->bss_lock);
         if (!list_empty(&bss->list)) {
-                __cfg80211_unlink_bss(dev, bss);
-                dev->bss_generation++;
+                if (__cfg80211_unlink_bss(dev, bss))
+                        dev->bss_generation++;
         }
         spin_unlock_bh(&dev->bss_lock);
 }
@@ -1155,16 +1210,6 @@ static void ieee80211_scan_add_ies(struct iw_request_info *info,
         }
 }
 
-static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
-{
-        unsigned long end = jiffies;
-
-        if (end >= start)
-                return jiffies_to_msecs(end - start);
-
-        return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
-}
-
 static char *
 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
               struct cfg80211_internal_bss *bss, char *current_ev,
@@ -1241,15 +1286,10 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
 
         rcu_read_lock();
         ies = rcu_dereference(bss->pub.ies);
-        if (ies) {
-                rem = ies->len;
-                ie = ies->data;
-        } else {
-                rem = 0;
-                ie = NULL;
-        }
+        rem = ies->len;
+        ie = ies->data;
 
-        while (ies && rem >= 2) {
+        while (rem >= 2) {
                 /* invalid data */
                 if (ie[1] > rem - 2)
                         break;
@@ -1362,7 +1402,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
         if (buf) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVCUSTOM;
-                sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->pub.tsf));
+                sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
                 iwe.u.data.length = strlen(buf);
                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
                                                   &iwe, buf);