4 files changed, 74 insertions, 15 deletions

diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index d0c92dddb26b..d8f443b70b08 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -44,6 +44,36 @@ rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
         return chan;
 }
 
+static bool can_beacon_sec_chan(struct wiphy *wiphy,
+                                struct ieee80211_channel *chan,
+                                enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_channel *sec_chan;
+        int diff;
+
+        switch (channel_type) {
+        case NL80211_CHAN_HT40PLUS:
+                diff = 20;
+        case NL80211_CHAN_HT40MINUS:
+                diff = -20;
+        default:
+                return false;
+        }
+
+        sec_chan = ieee80211_get_channel(wiphy, chan->center_freq + diff);
+        if (!sec_chan)
+                return false;
+
+        /* we'll need a DFS capability later */
+        if (sec_chan->flags & (IEEE80211_CHAN_DISABLED |
+                               IEEE80211_CHAN_PASSIVE_SCAN |
+                               IEEE80211_CHAN_NO_IBSS |
+                               IEEE80211_CHAN_RADAR))
+                return false;
+
+        return true;
+}
+
 int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
                       struct wireless_dev *wdev, int freq,
                       enum nl80211_channel_type channel_type)
@@ -68,6 +98,27 @@ int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
         if (!chan)
                 return -EINVAL;
 
+        /* Both channels should be able to initiate communication */
+        if (wdev && (wdev->iftype == NL80211_IFTYPE_ADHOC ||
+                     wdev->iftype == NL80211_IFTYPE_AP ||
+                     wdev->iftype == NL80211_IFTYPE_AP_VLAN ||
+                     wdev->iftype == NL80211_IFTYPE_MESH_POINT)) {
+                switch (channel_type) {
+                case NL80211_CHAN_HT40PLUS:
+                case NL80211_CHAN_HT40MINUS:
+                        if (!can_beacon_sec_chan(&rdev->wiphy, chan,
+                                                 channel_type)) {
+                                printk(KERN_DEBUG
+                                       "cfg80211: Secondary channel not "
+                                       "allowed to initiate communication\n");
+                                return -EINVAL;
+                        }
+                        break;
+                default:
+                        break;
+                }
+        }
+
         result = rdev->ops->set_channel(&rdev->wiphy,
                                         wdev ? wdev->netdev : NULL,
                                         chan, channel_type);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 37902a54e9c1..9a8cde999955 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -761,11 +761,13 @@ static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
 
         result = get_rdev_dev_by_info_ifindex(info, &rdev, &netdev);
         if (result)
-                goto unlock;
+                goto unlock_rtnl;
 
         result = __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
 
- unlock:
+        dev_put(netdev);
+        cfg80211_unlock_rdev(rdev);
+ unlock_rtnl:
         rtnl_unlock();
 
         return result;
@@ -4996,7 +4998,7 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
 
         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
         if (err)
-                goto unlock_rdev;
+                goto unlock_rtnl;
 
         wdev = dev->ieee80211_ptr;
 
@@ -5013,9 +5015,10 @@ static int nl80211_set_cqm_rssi(struct genl_info *info,
         err = rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
                                              threshold, hysteresis);
 
-unlock_rdev:
+ unlock_rdev:
         cfg80211_unlock_rdev(rdev);
         dev_put(dev);
+ unlock_rtnl:
         rtnl_unlock();
 
         return err;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index f180db0de66c..edccc093e71b 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -723,7 +723,9 @@ EXPORT_SYMBOL(freq_reg_info);
  * on the wiphy with the target_bw specified. Then we can simply use
  * that below for the desired_bw_khz below.
  */
-static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
+static void handle_channel(struct wiphy *wiphy,
+                           enum nl80211_reg_initiator initiator,
+                           enum ieee80211_band band,
                            unsigned int chan_idx)
 {
         int r;
@@ -787,7 +789,9 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                 chan->max_power = (int) MBM_TO_DBM(power_rule->max_eirp);
 }
 
-static void handle_band(struct wiphy *wiphy, enum ieee80211_band band)
+static void handle_band(struct wiphy *wiphy,
+                        enum ieee80211_band band,
+                        enum nl80211_reg_initiator initiator)
 {
         unsigned int i;
         struct ieee80211_supported_band *sband;
@@ -796,7 +800,7 @@ static void handle_band(struct wiphy *wiphy, enum ieee80211_band band)
         sband = wiphy->bands[band];
 
         for (i = 0; i < sband->n_channels; i++)
-                handle_channel(wiphy, band, i);
+                handle_channel(wiphy, initiator, band, i);
 }
 
 static bool ignore_reg_update(struct wiphy *wiphy,
@@ -812,6 +816,7 @@ static bool ignore_reg_update(struct wiphy *wiphy,
          * desired regulatory domain set
          */
         if (wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY && !wiphy->regd &&
+            initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
             !is_world_regdom(last_request->alpha2))
                 return true;
         return false;
@@ -1033,7 +1038,7 @@ void wiphy_update_regulatory(struct wiphy *wiphy,
                 goto out;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 if (wiphy->bands[band])
-                        handle_band(wiphy, band);
+                        handle_band(wiphy, band, initiator);
         }
 out:
         reg_process_beacons(wiphy);
@@ -1170,7 +1175,7 @@ static int ignore_request(struct wiphy *wiphy,
                                 return 0;
                         return -EALREADY;
                 }
-                return REG_INTERSECT;
+                return 0;
         case NL80211_REGDOM_SET_BY_DRIVER:
                 if (last_request->initiator == NL80211_REGDOM_SET_BY_CORE) {
                         if (regdom_changes(pending_request->alpha2))
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 5ca8c7180141..503ebb86ba18 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -650,14 +650,14 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
         bss = container_of(pub, struct cfg80211_internal_bss, pub);
 
         spin_lock_bh(&dev->bss_lock);
+        if (!list_empty(&bss->list)) {
+                list_del_init(&bss->list);
+                dev->bss_generation++;
+                rb_erase(&bss->rbn, &dev->bss_tree);
 
-        list_del(&bss->list);
-        dev->bss_generation++;
-        rb_erase(&bss->rbn, &dev->bss_tree);
-
+                kref_put(&bss->ref, bss_release);
+        }
         spin_unlock_bh(&dev->bss_lock);
-
-        kref_put(&bss->ref, bss_release);
 }
 EXPORT_SYMBOL(cfg80211_unlink_bss);