7 files changed, 51 insertions, 31 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 929f897a8ded..03fe6d1cff42 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1389,6 +1389,8 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
         else
                 memset(next_hop, 0, ETH_ALEN);
 
+        memset(pinfo, 0, sizeof(*pinfo));
+
         pinfo->generation = mesh_paths_generation;
 
         pinfo->filled = MPATH_INFO_FRAME_QLEN |
@@ -1407,7 +1409,6 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
         pinfo->discovery_timeout =
                         jiffies_to_msecs(mpath->discovery_timeout);
         pinfo->discovery_retries = mpath->discovery_retries;
-        pinfo->flags = 0;
         if (mpath->flags & MESH_PATH_ACTIVE)
                 pinfo->flags |= NL80211_MPATH_FLAG_ACTIVE;
         if (mpath->flags & MESH_PATH_RESOLVING)
@@ -1416,10 +1417,8 @@ static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
                 pinfo->flags |= NL80211_MPATH_FLAG_SN_VALID;
         if (mpath->flags & MESH_PATH_FIXED)
                 pinfo->flags |= NL80211_MPATH_FLAG_FIXED;
-        if (mpath->flags & MESH_PATH_RESOLVING)
-                pinfo->flags |= NL80211_MPATH_FLAG_RESOLVING;
-
-        pinfo->flags = mpath->flags;
+        if (mpath->flags & MESH_PATH_RESOLVED)
+                pinfo->flags |= NL80211_MPATH_FLAG_RESOLVED;
 }
 
 static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index f2d0d213bcfb..5f37add1571e 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -632,6 +632,7 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 
         del_timer_sync(&sdata->u.mesh.housekeeping_timer);
         del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
+        del_timer_sync(&sdata->u.mesh.mesh_path_timer);
         /*
          * If the timer fired while we waited for it, it will have
          * requeued the work. Now the work will be running again
@@ -644,6 +645,8 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         local->fif_other_bss--;
         atomic_dec(&local->iff_allmultis);
         ieee80211_configure_filter(local);
+
+        sdata->u.mesh.timers_running = 0;
 }
 
 static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index b65b2149b23b..5d77650d4363 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1467,6 +1467,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         del_timer_sync(&sdata->u.mgd.bcn_mon_timer);
         del_timer_sync(&sdata->u.mgd.timer);
         del_timer_sync(&sdata->u.mgd.chswitch_timer);
+
+        sdata->u.mgd.timers_running = 0;
 }
 
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
@@ -3298,6 +3300,8 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         goto out_unlock;
 
  err_clear:
+        memset(ifmgd->bssid, 0, ETH_ALEN);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
         ifmgd->auth_data = NULL;
  err_free:
         kfree(auth_data);
@@ -3506,6 +3510,8 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         err = 0;
         goto out;
  err_clear:
+        memset(ifmgd->bssid, 0, ETH_ALEN);
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
         ifmgd->assoc_data = NULL;
  err_free:
         kfree(assoc_data);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index ef1d69306315..740e414d44f4 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -299,7 +299,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
         if (local->scan_req != local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
-        local->scan_sdata = NULL;
+        rcu_assign_pointer(local->scan_sdata, NULL);
 
         local->scanning = 0;
         local->scan_channel = NULL;
@@ -984,7 +984,6 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata)
                         kfree(local->sched_scan_ies.ie[i]);
 
                 drv_sched_scan_stop(local, sdata);
-                rcu_assign_pointer(local->sched_scan_sdata, NULL);
         }
 out:
         mutex_unlock(&local->mtx);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3b807bcb8fc9..29eb4e678235 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1807,37 +1807,31 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
                                         sdata, NULL, NULL);
                 } else {
-                        int is_mesh_mcast = 1;
-                        const u8 *mesh_da;
+                        /* DS -> MBSS (802.11-2012 13.11.3.3).
+                         * For unicast with unknown forwarding information,
+                         * destination might be in the MBSS or if that fails
+                         * forwarded to another mesh gate. In either case
+                         * resolution will be handled in ieee80211_xmit(), so
+                         * leave the original DA. This also works for mcast */
+                        const u8 *mesh_da = skb->data;
+
+                        if (mppath)
+                                mesh_da = mppath->mpp;
+                        else if (mpath)
+                                mesh_da = mpath->dst;
+                        rcu_read_unlock();
 
-                        if (is_multicast_ether_addr(skb->data))
-                                /* DA TA mSA AE:SA */
-                                mesh_da = skb->data;
-                        else {
-                                static const u8 bcast[ETH_ALEN] =
-                                        { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-                                if (mppath) {
-                                        /* RA TA mDA mSA AE:DA SA */
-                                        mesh_da = mppath->mpp;
-                                        is_mesh_mcast = 0;
-                                } else if (mpath) {
-                                        mesh_da = mpath->dst;
-                                        is_mesh_mcast = 0;
-                                } else {
-                                        /* DA TA mSA AE:SA */
-                                        mesh_da = bcast;
-                                }
-                        }
                         hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
                                         mesh_da, sdata->vif.addr);
-                        rcu_read_unlock();
-                        if (is_mesh_mcast)
+                        if (is_multicast_ether_addr(mesh_da))
+                                /* DA TA mSA AE:SA */
                                 meshhdrlen =
                                         ieee80211_new_mesh_header(&mesh_hdr,
                                                         sdata,
                                                         skb->data + ETH_ALEN,
                                                         NULL);
                         else
+                                /* RA TA mDA mSA AE:DA SA */
                                 meshhdrlen =
                                         ieee80211_new_mesh_header(&mesh_hdr,
                                                         sdata,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 787aeaa902fe..222189b6ed53 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5656,8 +5656,10 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
                        sizeof(connect.ht_capa_mask));
 
         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
-                if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
+                if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
+                        kfree(connkeys);
                         return -EINVAL;
+                }
                 memcpy(&connect.ht_capa,
                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
                        sizeof(connect.ht_capa));
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index c6e0d467f8bd..1ad04e54014c 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -680,6 +680,8 @@ static u32 map_regdom_flags(u32 rd_flags)
                 channel_flags |= IEEE80211_CHAN_NO_IBSS;
         if (rd_flags & NL80211_RRF_DFS)
                 channel_flags |= IEEE80211_CHAN_RADAR;
+        if (rd_flags & NL80211_RRF_NO_OFDM)
+                channel_flags |= IEEE80211_CHAN_NO_OFDM;
         return channel_flags;
 }
 
@@ -901,7 +903,21 @@ static void handle_channel(struct wiphy *wiphy,
         chan->max_antenna_gain = min(chan->orig_mag,
                 (int) MBI_TO_DBI(power_rule->max_antenna_gain));
         chan->max_reg_power = (int) MBM_TO_DBM(power_rule->max_eirp);
-        chan->max_power = min(chan->max_power, chan->max_reg_power);
+        if (chan->orig_mpwr) {
+                /*
+                 * Devices that have their own custom regulatory domain
+                 * but also use WIPHY_FLAG_STRICT_REGULATORY will follow the
+                 * passed country IE power settings.
+                 */
+                if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+                    wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY &&
+                    wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY)
+                        chan->max_power = chan->max_reg_power;
+                else
+                        chan->max_power = min(chan->orig_mpwr,
+                                              chan->max_reg_power);
+        } else
+                chan->max_power = chan->max_reg_power;
 }
 
 static void handle_band(struct wiphy *wiphy,
@@ -1885,6 +1901,7 @@ static void restore_custom_reg_settings(struct wiphy *wiphy)
                         chan->flags = chan->orig_flags;
                         chan->max_antenna_gain = chan->orig_mag;
                         chan->max_power = chan->orig_mpwr;
+                        chan->beacon_found = false;
                 }
         }
 }