6 files changed, 26 insertions, 13 deletions

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index bfef5bae0b3a..84093b0000b9 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1175,6 +1175,12 @@ static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff
                                 hci_send_cmd(hdev,
                                         HCI_OP_READ_REMOTE_EXT_FEATURES,
                                                         sizeof(cp), &cp);
+                        } else if (!ev->status && conn->out &&
+                                        conn->sec_level == BT_SECURITY_HIGH) {
+                                struct hci_cp_auth_requested cp;
+                                cp.handle = ev->handle;
+                                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
+                                                        sizeof(cp), &cp);
                         } else {
                                 conn->state = BT_CONNECTED;
                                 hci_proto_connect_cfm(conn, ev->status);
diff --git a/net/bluetooth/hidp/Kconfig b/net/bluetooth/hidp/Kconfig
index 98fdfa1fbddd..86a91543172a 100644
--- a/net/bluetooth/hidp/Kconfig
+++ b/net/bluetooth/hidp/Kconfig
@@ -1,6 +1,6 @@
 config BT_HIDP
         tristate "HIDP protocol support"
-        depends on BT && BT_L2CAP && INPUT
+        depends on BT && BT_L2CAP && INPUT && HID_SUPPORT
         select HID
         help
           HIDP (Human Interface Device Protocol) is a transport layer
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index daa7a988d9a6..cd8f6ea03841 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2421,11 +2421,11 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned
                 break;
 
         case 2:
-                *val = __le16_to_cpu(*((__le16 *) opt->val));
+                *val = get_unaligned_le16(opt->val);
                 break;
 
         case 4:
-                *val = __le32_to_cpu(*((__le32 *) opt->val));
+                *val = get_unaligned_le32(opt->val);
                 break;
 
         default:
@@ -2452,11 +2452,11 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
                 break;
 
         case 2:
-                *((__le16 *) opt->val) = cpu_to_le16(val);
+                put_unaligned_le16(val, opt->val);
                 break;
 
         case 4:
-                *((__le32 *) opt->val) = cpu_to_le32(val);
+                put_unaligned_le32(val, opt->val);
                 break;
 
         default:
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 39a5d87e33b4..fa642aa652bd 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -79,7 +79,10 @@ static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
 
 static void rfcomm_process_connect(struct rfcomm_session *s);
 
-static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
+static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
+                                                        bdaddr_t *dst,
+                                                        u8 sec_level,
+                                                        int *err);
 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
 static void rfcomm_session_del(struct rfcomm_session *s);
 
@@ -401,7 +404,7 @@ static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst,
 
         s = rfcomm_session_get(src, dst);
         if (!s) {
-                s = rfcomm_session_create(src, dst, &err);
+                s = rfcomm_session_create(src, dst, d->sec_level, &err);
                 if (!s)
                         return err;
         }
@@ -679,7 +682,10 @@ static void rfcomm_session_close(struct rfcomm_session *s, int err)
         rfcomm_session_put(s);
 }
 
-static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
+static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
+                                                        bdaddr_t *dst,
+                                                        u8 sec_level,
+                                                        int *err)
 {
         struct rfcomm_session *s = NULL;
         struct sockaddr_l2 addr;
@@ -704,6 +710,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
         sk = sock->sk;
         lock_sock(sk);
         l2cap_pi(sk)->imtu = l2cap_mtu;
+        l2cap_pi(sk)->sec_level = sec_level;
         if (l2cap_ertm)
                 l2cap_pi(sk)->mode = L2CAP_MODE_ERTM;
         release_sock(sk);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index f9163b12c7f1..7aa85591dbe7 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -391,6 +391,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         u32 hw_reconf_flags = 0;
         int i;
 
+        if (local->scan_sdata == sdata)
+                ieee80211_scan_cancel(local);
+
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 
         /*
@@ -523,9 +526,6 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 synchronize_rcu();
                 skb_queue_purge(&sdata->skb_queue);
 
-                if (local->scan_sdata == sdata)
-                        ieee80211_scan_cancel(local);
-
                 /*
                  * Disable beaconing here for mesh only, AP and IBSS
                  * are already taken care of.
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index c506241f8637..4e78e3f26798 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -224,8 +224,8 @@ static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
         }
 
         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
-        if (IS_ERR(dev)) {
-                err = PTR_ERR(dev);
+        if (IS_ERR(*rdev)) {
+                err = PTR_ERR(*rdev);
                 goto out_rtnl;
         }