5 files changed, 114 insertions, 50 deletions

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 73d9f894ed5d..cb80a80504e6 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -671,7 +671,10 @@ struct ieee80211_local {
         struct cfg80211_scan_request int_scan_req;
         struct cfg80211_scan_request *scan_req;
         struct ieee80211_channel *scan_channel;
+        const u8 *orig_ies;
+        int orig_ies_len;
         int scan_channel_idx;
+        int scan_ies_len;
 
         enum { SCAN_SET_CHANNEL, SCAN_SEND_PROBE } scan_state;
         unsigned long last_scan_completed;
@@ -1090,9 +1093,11 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg,
                          u8 *extra, size_t extra_len,
                          const u8 *bssid, int encrypt);
+int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
+                             const u8 *ie, size_t ie_len);
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
-                              u8 *ssid, size_t ssid_len,
-                              u8 *ie, size_t ie_len);
+                              const u8 *ssid, size_t ssid_len,
+                              const u8 *ie, size_t ie_len);
 
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
                                   const size_t supp_rates_len,
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index ee58a7873699..b3bbe78821d9 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -729,22 +729,12 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         wiphy->privid = mac80211_wiphy_privid;
 
-        if (!ops->hw_scan) {
-                /* For hw_scan, driver needs to set these up. */
-                wiphy->max_scan_ssids = 4;
-
-                /* we support a maximum of 32 rates in cfg80211 */
-                wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN
-                                         - 2 - 32 /* SSID */
-                                         - 4 - 32 /* (ext) supp rates */;
-
-        }
-
         /* Yes, putting cfg80211_bss into ieee80211_bss is a hack */
         wiphy->bss_priv_size = sizeof(struct ieee80211_bss) -
                                sizeof(struct cfg80211_bss);
 
         local = wiphy_priv(wiphy);
+
         local->hw.wiphy = wiphy;
 
         local->hw.priv = (char *)local +
@@ -831,7 +821,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         enum ieee80211_band band;
         struct net_device *mdev;
         struct ieee80211_master_priv *mpriv;
-        int channels, i, j;
+        int channels, i, j, max_bitrates;
 
         /*
          * generic code guarantees at least one band,
@@ -839,18 +829,23 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
          * that hw.conf.channel is assigned
          */
         channels = 0;
+        max_bitrates = 0;
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 struct ieee80211_supported_band *sband;
 
                 sband = local->hw.wiphy->bands[band];
-                if (sband && !local->oper_channel) {
+                if (!sband)
+                        continue;
+                if (!local->oper_channel) {
                         /* init channel we're on */
                         local->hw.conf.channel =
                         local->oper_channel =
                         local->scan_channel = &sband->channels[0];
                 }
-                if (sband)
-                        channels += sband->n_channels;
+                channels += sband->n_channels;
+
+                if (max_bitrates < sband->n_bitrates)
+                        max_bitrates = sband->n_bitrates;
         }
 
         local->int_scan_req.n_channels = channels;
@@ -870,6 +865,30 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
                 local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
 
+        /*
+         * Calculate scan IE length -- we need this to alloc
+         * memory and to subtract from the driver limit. It
+         * includes the (extended) supported rates and HT
+         * information -- SSID is the driver's responsibility.
+         */
+        local->scan_ies_len = 4 + max_bitrates; /* (ext) supp rates */
+
+        if (!local->ops->hw_scan) {
+                /* For hw_scan, driver needs to set these up. */
+                local->hw.wiphy->max_scan_ssids = 4;
+                local->hw.wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
+        }
+
+        /*
+         * If the driver supports any scan IEs, then assume the
+         * limit includes the IEs mac80211 will add, otherwise
+         * leave it at zero and let the driver sort it out; we
+         * still pass our IEs to the driver but userspace will
+         * not be allowed to in that case.
+         */
+        if (local->hw.wiphy->max_scan_ie_len)
+                local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len;
+
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
                 goto fail_wiphy_register;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 3bf9839f5916..4ec1bfc7f6a9 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -285,6 +285,12 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         if (WARN_ON(!local->scan_req))
                 return;
 
+        if (local->hw_scanning) {
+                kfree(local->scan_req->ie);
+                local->scan_req->ie = local->orig_ies;
+                local->scan_req->ie_len = local->orig_ies_len;
+        }
+
         if (local->scan_req != &local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
@@ -457,12 +463,28 @@ int ieee80211_start_scan(struct ieee80211_sub_if_data *scan_sdata,
         }
 
         if (local->ops->hw_scan) {
-                int rc;
+                u8 *ies;
+                int rc, ielen;
+
+                ies = kmalloc(2 + IEEE80211_MAX_SSID_LEN +
+                              local->scan_ies_len + req->ie_len, GFP_KERNEL);
+                if (!ies)
+                        return -ENOMEM;
+
+                ielen = ieee80211_build_preq_ies(local, ies,
+                                                 req->ie, req->ie_len);
+                local->orig_ies = req->ie;
+                local->orig_ies_len = req->ie_len;
+                req->ie = ies;
+                req->ie_len = ielen;
 
                 local->hw_scanning = true;
                 rc = local->ops->hw_scan(local_to_hw(local), req);
                 if (rc) {
                         local->hw_scanning = false;
+                        kfree(ies);
+                        req->ie_len = local->orig_ies_len;
+                        req->ie = local->orig_ies;
                         return rc;
                 }
                 local->scan_sdata = scan_sdata;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 05caf34f31da..72b091317a7c 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -831,16 +831,57 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         ieee80211_tx_skb(sdata, skb, encrypt);
 }
 
+int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
+                             const u8 *ie, size_t ie_len)
+{
+        struct ieee80211_supported_band *sband;
+        u8 *pos, *supp_rates_len, *esupp_rates_len = NULL;
+        int i;
+
+        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+
+        pos = buffer;
+
+        *pos++ = WLAN_EID_SUPP_RATES;
+        supp_rates_len = pos;
+        *pos++ = 0;
+
+        for (i = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *rate = &sband->bitrates[i];
+
+                if (esupp_rates_len) {
+                        *esupp_rates_len += 1;
+                } else if (*supp_rates_len == 8) {
+                        *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                        esupp_rates_len = pos;
+                        *pos++ = 1;
+                } else
+                        *supp_rates_len += 1;
+
+                *pos++ = rate->bitrate / 5;
+        }
+
+        /*
+         * If adding more here, adjust code in main.c
+         * that calculates local->scan_ies_len.
+         */
+
+        if (ie) {
+                memcpy(pos, ie, ie_len);
+                pos += ie_len;
+        }
+
+        return pos - buffer;
+}
+
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
-                              u8 *ssid, size_t ssid_len,
-                              u8 *ie, size_t ie_len)
+                              const u8 *ssid, size_t ssid_len,
+                              const u8 *ie, size_t ie_len)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos, *supp_rates, *esupp_rates = NULL;
-        int i;
+        u8 *pos;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200 +
                             ie_len);
@@ -867,33 +908,9 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
         *pos++ = WLAN_EID_SSID;
         *pos++ = ssid_len;
         memcpy(pos, ssid, ssid_len);
+        pos += ssid_len;
 
-        supp_rates = skb_put(skb, 2);
-        supp_rates[0] = WLAN_EID_SUPP_RATES;
-        supp_rates[1] = 0;
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        for (i = 0; i < sband->n_bitrates; i++) {
-                struct ieee80211_rate *rate = &sband->bitrates[i];
-                if (esupp_rates) {
-                        pos = skb_put(skb, 1);
-                        esupp_rates[1]++;
-                } else if (supp_rates[1] == 8) {
-                        esupp_rates = skb_put(skb, 3);
-                        esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
-                        esupp_rates[1] = 1;
-                        pos = &esupp_rates[2];
-                } else {
-                        pos = skb_put(skb, 1);
-                        supp_rates[1]++;
-                }
-                *pos = rate->bitrate / 5;
-        }
-
-        /* if adding more here, adjust max_scan_ie_len */
-
-        if (ie)
-                memcpy(skb_put(skb, ie_len), ie, ie_len);
+        skb_put(skb, ieee80211_build_preq_ies(local, pos, ie, ie_len));
 
         ieee80211_tx_skb(sdata, skb, 0);
 }
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 447fa1790b4e..68c51022e9dd 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2597,7 +2597,8 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
 
         if (info->attrs[NL80211_ATTR_IE]) {
                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
-                memcpy(request->ie, nla_data(info->attrs[NL80211_ATTR_IE]),
+                memcpy((void *)request->ie,
+                       nla_data(info->attrs[NL80211_ATTR_IE]),
                        request->ie_len);
         }