5 files changed, 27 insertions, 13 deletions

diff --git a/net/wireless/core.c b/net/wireless/core.c
index 67153964aad2..aff959e5a1b3 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -566,18 +566,13 @@ int wiphy_register(struct wiphy *wiphy)
         /* check and set up bitrates */
         ieee80211_set_bitrate_flags(wiphy);
 
-
+        rtnl_lock();
         res = device_add(&rdev->wiphy.dev);
-        if (res)
-                return res;
-
-        res = rfkill_register(rdev->rfkill);
         if (res) {
-                device_del(&rdev->wiphy.dev);
+                rtnl_unlock();
                 return res;
         }
 
-        rtnl_lock();
         /* set up regulatory info */
         wiphy_regulatory_register(wiphy);
 
@@ -606,6 +601,15 @@ int wiphy_register(struct wiphy *wiphy)
 
         rdev->wiphy.registered = true;
         rtnl_unlock();
+
+        res = rfkill_register(rdev->rfkill);
+        if (res) {
+                rfkill_destroy(rdev->rfkill);
+                rdev->rfkill = NULL;
+                wiphy_unregister(&rdev->wiphy);
+                return res;
+        }
+
         return 0;
 }
 EXPORT_SYMBOL(wiphy_register);
@@ -640,7 +644,8 @@ void wiphy_unregister(struct wiphy *wiphy)
                 rtnl_unlock();
                 __count == 0; }));
 
-        rfkill_unregister(rdev->rfkill);
+        if (rdev->rfkill)
+                rfkill_unregister(rdev->rfkill);
 
         rtnl_lock();
         rdev->wiphy.registered = false;
@@ -953,8 +958,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
         case NETDEV_PRE_UP:
                 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
                         return notifier_from_errno(-EOPNOTSUPP);
-                if (rfkill_blocked(rdev->rfkill))
-                        return notifier_from_errno(-ERFKILL);
                 ret = cfg80211_can_add_interface(rdev, wdev->iftype);
                 if (ret)
                         return notifier_from_errno(ret);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 9ad43c619c54..3159e9c284c5 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -411,6 +411,9 @@ static inline int
 cfg80211_can_add_interface(struct cfg80211_registered_device *rdev,
                            enum nl80211_iftype iftype)
 {
+        if (rfkill_blocked(rdev->rfkill))
+                return -ERFKILL;
+
         return cfg80211_can_change_interface(rdev, NULL, iftype);
 }
 
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 39bff7d36768..403fe29c024d 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -263,6 +263,8 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
                                         continue;
                                 wdev->wext.ibss.chandef.chan = chan;
+                                wdev->wext.ibss.chandef.center_freq1 =
+                                        chan->center_freq;
                                 break;
                         }
 
@@ -347,6 +349,7 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
         if (chan) {
                 wdev->wext.ibss.chandef.chan = chan;
                 wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                wdev->wext.ibss.chandef.center_freq1 = freq;
                 wdev->wext.ibss.channel_fixed = true;
         } else {
                 /* cfg80211_ibss_wext_join will pick one if needed */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index af8d84a4a5b2..626dc3b5fd8d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2421,7 +2421,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                 change = true;
         }
 
-        if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
+        if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                 return -EOPNOTSUPP;
 
@@ -2483,7 +2483,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
 
-        if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
+        if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                 return -EOPNOTSUPP;
 
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index 7d604c06c3dc..a271c27fac77 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -97,6 +97,10 @@ int ieee80211_radiotap_iterator_init(
         struct ieee80211_radiotap_header *radiotap_header,
         int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
 {
+        /* check the radiotap header can actually be present */
+        if (max_length < sizeof(struct ieee80211_radiotap_header))
+                return -EINVAL;
+
         /* Linux only supports version 0 radiotap format */
         if (radiotap_header->it_version)
                 return -EINVAL;
@@ -131,7 +135,8 @@ int ieee80211_radiotap_iterator_init(
                          */
 
                         if ((unsigned long)iterator->_arg -
-                            (unsigned long)iterator->_rtheader >
+                            (unsigned long)iterator->_rtheader +
+                            sizeof(uint32_t) >
                             (unsigned long)iterator->_max_length)
                                 return -EINVAL;
                 }