15 files changed, 164 insertions, 31 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index ac28af74a414..b0a651cc389f 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3564,7 +3564,7 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
                 return -EINVAL;
         }
         band = chanctx_conf->def.chan->band;
-        sta = sta_info_get(sdata, peer);
+        sta = sta_info_get_bss(sdata, peer);
         if (sta) {
                 qos = test_sta_flag(sta, WLAN_STA_WME);
         } else {
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 3a87c8976a32..fe48b093d4dc 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -334,6 +334,7 @@ enum ieee80211_sta_flags {
         IEEE80211_STA_DISABLE_VHT       = BIT(11),
         IEEE80211_STA_DISABLE_80P80MHZ  = BIT(12),
         IEEE80211_STA_DISABLE_160MHZ    = BIT(13),
+        IEEE80211_STA_DISABLE_WMM       = BIT(14),
 };
 
 struct ieee80211_mgd_auth_data {
@@ -893,6 +894,8 @@ struct tpt_led_trigger {
  *      that the scan completed.
  * @SCAN_ABORTED: Set for our scan work function when the driver reported
  *      a scan complete for an aborted scan.
+ * @SCAN_HW_CANCELLED: Set for our scan work function when the scan is being
+ *      cancelled.
  */
 enum {
         SCAN_SW_SCANNING,
@@ -900,6 +903,7 @@ enum {
         SCAN_ONCHANNEL_SCANNING,
         SCAN_COMPLETED,
         SCAN_ABORTED,
+        SCAN_HW_CANCELLED,
 };
 
 /**
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 91cc8281e266..d7bdc4b97dde 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2527,7 +2527,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
          */
         ifmgd->wmm_last_param_set = -1;
 
-        if (elems.wmm_param)
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) && elems.wmm_param)
                 ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
                                          elems.wmm_param_len);
         else
@@ -2955,7 +2955,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         ieee80211_sta_process_chanswitch(sdata, rx_status->mactime,
                                          &elems, true);
 
-        if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_WMM) &&
+            ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
                                      elems.wmm_param_len))
                 changed |= BSS_CHANGED_QOS;
 
@@ -3937,6 +3938,44 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         return err;
 }
 
+static bool ieee80211_usable_wmm_params(struct ieee80211_sub_if_data *sdata,
+                                        const u8 *wmm_param, int len)
+{
+        const u8 *pos;
+        size_t left;
+
+        if (len < 8)
+                return false;
+
+        if (wmm_param[5] != 1 /* version */)
+                return false;
+
+        pos = wmm_param + 8;
+        left = len - 8;
+
+        for (; left >= 4; left -= 4, pos += 4) {
+                u8 aifsn = pos[0] & 0x0f;
+                u8 ecwmin = pos[1] & 0x0f;
+                u8 ecwmax = (pos[1] & 0xf0) >> 4;
+                int aci = (pos[0] >> 5) & 0x03;
+
+                if (aifsn < 2) {
+                        sdata_info(sdata,
+                                   "AP has invalid WMM params (AIFSN=%d for ACI %d), disabling WMM\n",
+                                   aifsn, aci);
+                        return false;
+                }
+                if (ecwmin > ecwmax) {
+                        sdata_info(sdata,
+                                   "AP has invalid WMM params (ECWmin/max=%d/%d for ACI %d), disabling WMM\n",
+                                   ecwmin, ecwmax, aci);
+                        return false;
+                }
+        }
+
+        return true;
+}
+
 int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                         struct cfg80211_assoc_request *req)
 {
@@ -3994,9 +4033,45 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         }
 
         /* prepare assoc data */
-        
+
         ifmgd->beacon_crc_valid = false;
 
+        assoc_data->wmm = bss->wmm_used &&
+                          (local->hw.queues >= IEEE80211_NUM_ACS);
+        if (assoc_data->wmm) {
+                /* try to check validity of WMM params IE */
+                const struct cfg80211_bss_ies *ies;
+                const u8 *wp, *start, *end;
+
+                rcu_read_lock();
+                ies = rcu_dereference(req->bss->ies);
+                start = ies->data;
+                end = start + ies->len;
+
+                while (true) {
+                        wp = cfg80211_find_vendor_ie(
+                                WLAN_OUI_MICROSOFT,
+                                WLAN_OUI_TYPE_MICROSOFT_WMM,
+                                start, end - start);
+                        if (!wp)
+                                break;
+                        start = wp + wp[1] + 2;
+                        /* if this IE is too short, try the next */
+                        if (wp[1] <= 4)
+                                continue;
+                        /* if this IE is WMM params, we found what we wanted */
+                        if (wp[6] == 1)
+                                break;
+                }
+
+                if (!wp || !ieee80211_usable_wmm_params(sdata, wp + 2,
+                                                        wp[1] - 2)) {
+                        assoc_data->wmm = false;
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_WMM;
+                }
+                rcu_read_unlock();
+        }
+
         /*
          * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
          * We still associate in non-HT mode (11a/b/g) if any one of these
@@ -4026,18 +4101,22 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         /* Also disable HT if we don't support it or the AP doesn't use WMM */
         sband = local->hw.wiphy->bands[req->bss->channel->band];
         if (!sband->ht_cap.ht_supported ||
-            local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
+            local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
+            ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
-                if (!bss->wmm_used)
+                if (!bss->wmm_used &&
+                    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
                         netdev_info(sdata->dev,
                                     "disabling HT as WMM/QoS is not supported by the AP\n");
         }
 
         /* disable VHT if we don't support it or the AP doesn't use WMM */
         if (!sband->vht_cap.vht_supported ||
-            local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
+            local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used ||
+            ifmgd->flags & IEEE80211_STA_DISABLE_WMM) {
                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
-                if (!bss->wmm_used)
+                if (!bss->wmm_used &&
+                    !(ifmgd->flags & IEEE80211_STA_DISABLE_WMM))
                         netdev_info(sdata->dev,
                                     "disabling VHT as WMM/QoS is not supported by the AP\n");
         }
@@ -4066,8 +4145,6 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                 sdata->smps_mode = ifmgd->req_smps;
 
         assoc_data->capability = req->bss->capability;
-        assoc_data->wmm = bss->wmm_used &&
-                          (local->hw.queues >= IEEE80211_NUM_ACS);
         assoc_data->supp_rates = bss->supp_rates;
         assoc_data->supp_rates_len = bss->supp_rates_len;
 
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index acd1f71adc03..0c2a29484c07 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -394,6 +394,8 @@ void ieee80211_sw_roc_work(struct work_struct *work)
 
                 if (started)
                         ieee80211_start_next_roc(local);
+                else if (list_empty(&local->roc_list))
+                        ieee80211_run_deferred_scan(local);
         }
 
  out_unlock:
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index e126605cec66..22b223f13c9f 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -235,7 +235,8 @@ static void rc_send_low_basicrate(s8 *idx, u32 basic_rates,
 static void __rate_control_send_low(struct ieee80211_hw *hw,
                                     struct ieee80211_supported_band *sband,
                                     struct ieee80211_sta *sta,
-                                    struct ieee80211_tx_info *info)
+                                    struct ieee80211_tx_info *info,
+                                    u32 rate_mask)
 {
         int i;
         u32 rate_flags =
@@ -247,6 +248,12 @@ static void __rate_control_send_low(struct ieee80211_hw *hw,
 
         info->control.rates[0].idx = 0;
         for (i = 0; i < sband->n_bitrates; i++) {
+                if (!(rate_mask & BIT(i)))
+                        continue;
+
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+
                 if (!rate_supported(sta, sband->band, i))
                         continue;
 
@@ -274,7 +281,8 @@ bool rate_control_send_low(struct ieee80211_sta *pubsta,
         bool use_basicrate = false;
 
         if (!pubsta || !priv_sta || rc_no_data_or_no_ack_use_min(txrc)) {
-                __rate_control_send_low(txrc->hw, sband, pubsta, info);
+                __rate_control_send_low(txrc->hw, sband, pubsta, info,
+                                        txrc->rate_idx_mask);
 
                 if (!pubsta && txrc->bss) {
                         mcast_rate = txrc->bss_conf->mcast_rate[sband->band];
@@ -656,7 +664,8 @@ void ieee80211_get_tx_rates(struct ieee80211_vif *vif,
                 rate_control_apply_mask(sdata, sta, sband, info, dest, max_rates);
 
         if (dest[0].idx < 0)
-                __rate_control_send_low(&sdata->local->hw, sband, sta, info);
+                __rate_control_send_low(&sdata->local->hw, sband, sta, info,
+                                        sdata->rc_rateidx_mask[info->band]);
 
         if (sta)
                 rate_fixup_ratelist(vif, sband, info, dest, max_rates);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index f0247a43a75c..0011ac815097 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3073,6 +3073,9 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
         case NL80211_IFTYPE_ADHOC:
                 if (!bssid)
                         return 0;
+                if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
+                    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
+                        return 0;
                 if (ieee80211_is_beacon(hdr->frame_control)) {
                         return 1;
                 } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index ecb57b0bf74a..5ad66a83ef7f 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -238,6 +238,9 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
         enum ieee80211_band band;
         int i, ielen, n_chans;
 
+        if (test_bit(SCAN_HW_CANCELLED, &local->scanning))
+                return false;
+
         do {
                 if (local->hw_scan_band == IEEE80211_NUM_BANDS)
                         return false;
@@ -939,7 +942,23 @@ void ieee80211_scan_cancel(struct ieee80211_local *local)
         if (!local->scan_req)
                 goto out;
 
+        /*
+         * We have a scan running and the driver already reported completion,
+         * but the worker hasn't run yet or is stuck on the mutex - mark it as
+         * cancelled.
+         */
+        if (test_bit(SCAN_HW_SCANNING, &local->scanning) &&
+            test_bit(SCAN_COMPLETED, &local->scanning)) {
+                set_bit(SCAN_HW_CANCELLED, &local->scanning);
+                goto out;
+        }
+
         if (test_bit(SCAN_HW_SCANNING, &local->scanning)) {
+                /*
+                 * Make sure that __ieee80211_scan_completed doesn't trigger a
+                 * scan on another band.
+                 */
+                set_bit(SCAN_HW_CANCELLED, &local->scanning);
                 if (local->ops->cancel_hw_scan)
                         drv_cancel_hw_scan(local,
                                 rcu_dereference_protected(local->scan_sdata,
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 368837fe3b80..78dc2e99027e 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -180,6 +180,9 @@ static void ieee80211_frame_acked(struct sta_info *sta, struct sk_buff *skb)
         struct ieee80211_local *local = sta->local;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
 
+        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                sta->last_rx = jiffies;
+
         if (ieee80211_is_data_qos(mgmt->frame_control)) {
                 struct ieee80211_hdr *hdr = (void *) skb->data;
                 u8 *qc = ieee80211_get_qos_ctl(hdr);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 4fcbf634b548..9993fcb19ecd 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1120,7 +1120,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                 tx->sta = rcu_dereference(sdata->u.vlan.sta);
                 if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
                         return TX_DROP;
-        } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
+        } else if (info->flags & (IEEE80211_TX_CTL_INJECTED |
+                                  IEEE80211_TX_INTFL_NL80211_FRAME_TX) ||
                    tx->sdata->control_port_protocol == tx->skb->protocol) {
                 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
         }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 550a6880625d..aefb9d5b9620 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2101,7 +2101,7 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
-        int rate, skip, shift;
+        int rate, shift;
         u8 i, exrates, *pos;
         u32 basic_rates = sdata->vif.bss_conf.basic_rates;
         u32 rate_flags;
@@ -2129,14 +2129,11 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
                 pos = skb_put(skb, exrates + 2);
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
                 *pos++ = exrates;
-                skip = 0;
                 for (i = 8; i < sband->n_bitrates; i++) {
                         u8 basic = 0;
                         if ((rate_flags & sband->bitrates[i].flags)
                             != rate_flags)
                                 continue;
-                        if (skip++ < 8)
-                                continue;
                         if (need_basic && basic_rates & BIT(i))
                                 basic = 0x80;
                         rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
@@ -2239,6 +2236,10 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
         }
 
         rate = cfg80211_calculate_bitrate(&ri);
+        if (WARN_ONCE(!rate,
+                      "Invalid bitrate: flags=0x%x, idx=%d, vht_nss=%d\n",
+                      status->flag, status->rate_idx, status->vht_nss))
+                return 0;
 
         /* rewind from end of MPDU */
         if (status->flag & RX_FLAG_MACTIME_END)
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 67153964aad2..aff959e5a1b3 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -566,18 +566,13 @@ int wiphy_register(struct wiphy *wiphy)
         /* check and set up bitrates */
         ieee80211_set_bitrate_flags(wiphy);
 
-
+        rtnl_lock();
         res = device_add(&rdev->wiphy.dev);
-        if (res)
-                return res;
-
-        res = rfkill_register(rdev->rfkill);
         if (res) {
-                device_del(&rdev->wiphy.dev);
+                rtnl_unlock();
                 return res;
         }
 
-        rtnl_lock();
         /* set up regulatory info */
         wiphy_regulatory_register(wiphy);
 
@@ -606,6 +601,15 @@ int wiphy_register(struct wiphy *wiphy)
 
         rdev->wiphy.registered = true;
         rtnl_unlock();
+
+        res = rfkill_register(rdev->rfkill);
+        if (res) {
+                rfkill_destroy(rdev->rfkill);
+                rdev->rfkill = NULL;
+                wiphy_unregister(&rdev->wiphy);
+                return res;
+        }
+
         return 0;
 }
 EXPORT_SYMBOL(wiphy_register);
@@ -640,7 +644,8 @@ void wiphy_unregister(struct wiphy *wiphy)
                 rtnl_unlock();
                 __count == 0; }));
 
-        rfkill_unregister(rdev->rfkill);
+        if (rdev->rfkill)
+                rfkill_unregister(rdev->rfkill);
 
         rtnl_lock();
         rdev->wiphy.registered = false;
@@ -953,8 +958,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
         case NETDEV_PRE_UP:
                 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
                         return notifier_from_errno(-EOPNOTSUPP);
-                if (rfkill_blocked(rdev->rfkill))
-                        return notifier_from_errno(-ERFKILL);
                 ret = cfg80211_can_add_interface(rdev, wdev->iftype);
                 if (ret)
                         return notifier_from_errno(ret);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index b43efac4efca..eb0f7a3a25a9 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -402,6 +402,9 @@ static inline int
 cfg80211_can_add_interface(struct cfg80211_registered_device *rdev,
                            enum nl80211_iftype iftype)
 {
+        if (rfkill_blocked(rdev->rfkill))
+                return -ERFKILL;
+
         return cfg80211_can_change_interface(rdev, NULL, iftype);
 }
 
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 39bff7d36768..403fe29c024d 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -263,6 +263,8 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
                                         continue;
                                 wdev->wext.ibss.chandef.chan = chan;
+                                wdev->wext.ibss.chandef.center_freq1 =
+                                        chan->center_freq;
                                 break;
                         }
 
@@ -347,6 +349,7 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
         if (chan) {
                 wdev->wext.ibss.chandef.chan = chan;
                 wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                wdev->wext.ibss.chandef.center_freq1 = freq;
                 wdev->wext.ibss.channel_fixed = true;
         } else {
                 /* cfg80211_ibss_wext_join will pick one if needed */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2838206ddad3..cbbef88a8ebd 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2421,7 +2421,7 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                 change = true;
         }
 
-        if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
+        if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                 return -EOPNOTSUPP;
 
@@ -2483,7 +2483,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
 
-        if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
+        if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
                 return -EOPNOTSUPP;
 
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index 7d604c06c3dc..a271c27fac77 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -97,6 +97,10 @@ int ieee80211_radiotap_iterator_init(
         struct ieee80211_radiotap_header *radiotap_header,
         int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
 {
+        /* check the radiotap header can actually be present */
+        if (max_length < sizeof(struct ieee80211_radiotap_header))
+                return -EINVAL;
+
         /* Linux only supports version 0 radiotap format */
         if (radiotap_header->it_version)
                 return -EINVAL;
@@ -131,7 +135,8 @@ int ieee80211_radiotap_iterator_init(
                          */
 
                         if ((unsigned long)iterator->_arg -
-                            (unsigned long)iterator->_rtheader >
+                            (unsigned long)iterator->_rtheader +
+                            sizeof(uint32_t) >
                             (unsigned long)iterator->_max_length)
                                 return -EINVAL;
                 }