7 files changed, 144 insertions, 42 deletions

diff --git a/net/wireless/core.h b/net/wireless/core.h
index 796a4bdf8b0d..b9ec3061ed72 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -375,7 +375,8 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                           struct ieee80211_channel *chan, bool offchan,
                           enum nl80211_channel_type channel_type,
                           bool channel_type_valid, unsigned int wait,
-                          const u8 *buf, size_t len, u64 *cookie);
+                          const u8 *buf, size_t len, bool no_cck,
+                          u64 *cookie);
 
 /* SME */
 int __cfg80211_connect(struct cfg80211_registered_device *rdev,
@@ -406,6 +407,7 @@ void cfg80211_sme_failed_assoc(struct wireless_dev *wdev);
 bool cfg80211_sme_failed_reassoc(struct wireless_dev *wdev);
 
 /* internal helpers */
+bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher);
 int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
                                    struct key_params *params, int key_idx,
                                    bool pairwise, const u8 *mac_addr);
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 832f6574e4ed..21fc9702f81c 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -900,7 +900,8 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                           struct ieee80211_channel *chan, bool offchan,
                           enum nl80211_channel_type channel_type,
                           bool channel_type_valid, unsigned int wait,
-                          const u8 *buf, size_t len, u64 *cookie)
+                          const u8 *buf, size_t len, bool no_cck,
+                          u64 *cookie)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         const struct ieee80211_mgmt *mgmt;
@@ -991,7 +992,7 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
         /* Transmit the Action frame as requested by user space */
         return rdev->ops->mgmt_tx(&rdev->wiphy, dev, chan, offchan,
                                   channel_type, channel_type_valid,
-                                  wait, buf, len, cookie);
+                                  wait, buf, len, no_cck, cookie);
 }
 
 bool cfg80211_rx_mgmt(struct net_device *dev, int freq, const u8 *buf,
@@ -1095,3 +1096,14 @@ void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
 }
 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
+
+void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
+                                     const u8 *bssid, bool preauth, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
+}
+EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 11089541bb03..b85075761e24 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -191,6 +191,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
                                          .len = IEEE80211_MAX_DATA_LEN },
         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
+        [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 };
 
 /* policy for the key attributes */
@@ -1235,6 +1236,11 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         goto bad_res;
                 }
 
+                if (!netdev) {
+                        result = -EINVAL;
+                        goto bad_res;
+                }
+
                 nla_for_each_nested(nl_txq_params,
                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
                                     rem_txq_params) {
@@ -1247,6 +1253,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                                 goto bad_res;
 
                         result = rdev->ops->set_txq_params(&rdev->wiphy,
+                                                           netdev,
                                                            &txq_params);
                         if (result)
                                 goto bad_res;
@@ -2613,7 +2620,7 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
 
         /* parse WME attributes if sta is WME capable */
         if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
-            (params.sta_flags_set & NL80211_STA_FLAG_WME) &&
+            (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
             info->attrs[NL80211_ATTR_STA_WME]) {
                 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
                 struct nlattr *nla;
@@ -3620,6 +3627,9 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
+        request->no_cck =
+                nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
+
         request->dev = dev;
         request->wiphy = &rdev->wiphy;
 
@@ -4126,22 +4136,6 @@ static bool nl80211_valid_wpa_versions(u32 wpa_versions)
                                   NL80211_WPA_VERSION_2));
 }
 
-static bool nl80211_valid_akm_suite(u32 akm)
-{
-        return akm == WLAN_AKM_SUITE_8021X ||
-                akm == WLAN_AKM_SUITE_PSK;
-}
-
-static bool nl80211_valid_cipher_suite(u32 cipher)
-{
-        return cipher == WLAN_CIPHER_SUITE_WEP40 ||
-                cipher == WLAN_CIPHER_SUITE_WEP104 ||
-                cipher == WLAN_CIPHER_SUITE_TKIP ||
-                cipher == WLAN_CIPHER_SUITE_CCMP ||
-                cipher == WLAN_CIPHER_SUITE_AES_CMAC;
-}
-
-
 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -4274,7 +4268,8 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
                 memcpy(settings->ciphers_pairwise, data, len);
 
                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
-                        if (!nl80211_valid_cipher_suite(
+                        if (!cfg80211_supported_cipher_suite(
+                                        &rdev->wiphy,
                                         settings->ciphers_pairwise[i]))
                                 return -EINVAL;
         }
@@ -4282,7 +4277,8 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
                 settings->cipher_group =
                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
-                if (!nl80211_valid_cipher_suite(settings->cipher_group))
+                if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
+                                                     settings->cipher_group))
                         return -EINVAL;
         }
 
@@ -4295,7 +4291,7 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
 
         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
                 void *data;
-                int len, i;
+                int len;
 
                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
@@ -4304,11 +4300,10 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
                 if (len % sizeof(u32))
                         return -EINVAL;
 
-                memcpy(settings->akm_suites, data, len);
+                if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
+                        return -EINVAL;
 
-                for (i = 0; i < settings->n_ciphers_pairwise; i++)
-                        if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
-                                return -EINVAL;
+                memcpy(settings->akm_suites, data, len);
         }
 
         return 0;
@@ -4527,8 +4522,12 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
 
         wiphy = &rdev->wiphy;
 
-        if (info->attrs[NL80211_ATTR_MAC])
+        if (info->attrs[NL80211_ATTR_MAC]) {
                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
+
+                if (!is_valid_ether_addr(ibss.bssid))
+                        return -EINVAL;
+        }
         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
 
@@ -5185,6 +5184,7 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
         struct sk_buff *msg;
         unsigned int wait = 0;
         bool offchan;
+        bool no_cck;
 
         if (!info->attrs[NL80211_ATTR_FRAME] ||
             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
@@ -5221,6 +5221,8 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
 
         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
 
+        no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
+
         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
         chan = rdev_freq_to_chan(rdev, freq, channel_type);
         if (chan == NULL)
@@ -5241,7 +5243,7 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
                                     channel_type_valid, wait,
                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
-                                    &cookie);
+                                    no_cck, &cookie);
         if (err)
                 goto free_msg;
 
@@ -7266,6 +7268,52 @@ void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
+void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
+                                    struct net_device *netdev, int index,
+                                    const u8 *bssid, bool preauth, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        struct nlattr *attr;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+
+        attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
+        if (!attr)
+                goto nla_put_failure;
+
+        NLA_PUT_U32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index);
+        NLA_PUT(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid);
+        if (preauth)
+                NLA_PUT_FLAG(msg, NL80211_PMKSA_CANDIDATE_PREAUTH);
+
+        nla_nest_end(msg, attr);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
 void
 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
                                 struct net_device *netdev, const u8 *peer,
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 5d69c56400ae..f24a1fbeaf19 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -113,4 +113,8 @@ void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
                               struct net_device *netdev, const u8 *bssid,
                               const u8 *replay_ctr, gfp_t gfp);
 
+void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
+                                    struct net_device *netdev, int index,
+                                    const u8 *bssid, bool preauth, gfp_t gfp);
+
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index b0f003966953..0fb142410404 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -228,6 +228,33 @@ const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
 }
 EXPORT_SYMBOL(cfg80211_find_ie);
 
+const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
+                                  const u8 *ies, int len)
+{
+        struct ieee80211_vendor_ie *ie;
+        const u8 *pos = ies, *end = ies + len;
+        int ie_oui;
+
+        while (pos < end) {
+                pos = cfg80211_find_ie(WLAN_EID_VENDOR_SPECIFIC, pos,
+                                       end - pos);
+                if (!pos)
+                        return NULL;
+
+                if (end - pos < sizeof(*ie))
+                        return NULL;
+
+                ie = (struct ieee80211_vendor_ie *)pos;
+                ie_oui = ie->oui[0] << 16 | ie->oui[1] << 8 | ie->oui[2];
+                if (ie_oui == oui && ie->oui_type == oui_type)
+                        return pos;
+
+                pos += 2 + ie->len;
+        }
+        return NULL;
+}
+EXPORT_SYMBOL(cfg80211_find_vendor_ie);
+
 static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
 {
         const u8 *ie1 = cfg80211_find_ie(num, ies1, len1);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index dec0fa28372e..6e86d5acf145 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -110,17 +110,22 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         else {
                 int i = 0, j;
                 enum ieee80211_band band;
+                struct ieee80211_supported_band *bands;
+                struct ieee80211_channel *channel;
 
                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
-                        if (!wdev->wiphy->bands[band])
+                        bands = wdev->wiphy->bands[band];
+                        if (!bands)
                                 continue;
-                        for (j = 0; j < wdev->wiphy->bands[band]->n_channels;
-                             i++, j++)
-                                request->channels[i] =
-                                        &wdev->wiphy->bands[band]->channels[j];
-                        request->rates[band] =
-                                (1 << wdev->wiphy->bands[band]->n_bitrates) - 1;
+                        for (j = 0; j < bands->n_channels; j++) {
+                                channel = &bands->channels[j];
+                                if (channel->flags & IEEE80211_CHAN_DISABLED)
+                                        continue;
+                                request->channels[i++] = channel;
+                        }
+                        request->rates[band] = (1 << bands->n_bitrates) - 1;
                 }
+                n_channels = i;
         }
         request->n_channels = n_channels;
         request->ssids = (void *)&request->channels[n_channels];
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 39dbf4ad7ca1..6304ed63588a 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -151,12 +151,19 @@ void ieee80211_set_bitrate_flags(struct wiphy *wiphy)
                         set_mandatory_flags_band(wiphy->bands[band], band);
 }
 
+bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher)
+{
+        int i;
+        for (i = 0; i < wiphy->n_cipher_suites; i++)
+                if (cipher == wiphy->cipher_suites[i])
+                        return true;
+        return false;
+}
+
 int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
                                    struct key_params *params, int key_idx,
                                    bool pairwise, const u8 *mac_addr)
 {
-        int i;
-
         if (key_idx > 5)
                 return -EINVAL;
 
@@ -226,10 +233,7 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
                 }
         }
 
-        for (i = 0; i < rdev->wiphy.n_cipher_suites; i++)
-                if (params->cipher == rdev->wiphy.cipher_suites[i])
-                        break;
-        if (i == rdev->wiphy.n_cipher_suites)
+        if (!cfg80211_supported_cipher_suite(&rdev->wiphy, params->cipher))
                 return -EINVAL;
 
         return 0;