Merge remote-tracking branch 'wireless-next/master' into mac80211-next

diff --combined net/mac80211/cfg.c
index 7f01f2aec7b57e08b61bbabea9147c65eda27d69,363d19b5d5c8d4bb88b75d537b69b7bef68f768e..3849fd07a32171cf8826b1e2509c4250379a456f
--- 1/net/mac80211/cfg.c
--- 2/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@@ -1021,8 -1021,10 +1021,10 @@@ static int ieee80211_start_ap(struct wi
                                        IEEE80211_P2P_OPPPS_ENABLE_BIT;
  
        err = ieee80211_assign_beacon(sdata, &params->beacon);
-       if (err < 0)
+       if (err < 0) {
+               ieee80211_vif_release_channel(sdata);
                return err;
+       }
        changed |= err;
  
        err = drv_start_ap(sdata->local, sdata);
@@@ -1032,6 -1034,7 +1034,7 @@@
                if (old)
                        kfree_rcu(old, rcu_head);
                RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
+               ieee80211_vif_release_channel(sdata);
                return err;
        }
  
@@@ -1093,8 -1096,6 +1096,6 @@@ static int ieee80211_stop_ap(struct wip
        kfree(sdata->u.ap.next_beacon);
        sdata->u.ap.next_beacon = NULL;
  
-       cancel_work_sync(&sdata->u.ap.request_smps_work);
- 
        /* turn off carrier for this interface and dependent VLANs */
        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
                netif_carrier_off(vlan->dev);
@@@ -1106,6 -1107,7 +1107,7 @@@
        kfree_rcu(old_beacon, rcu_head);
        if (old_probe_resp)
                kfree_rcu(old_probe_resp, rcu_head);
+       sdata->u.ap.driver_smps_mode = IEEE80211_SMPS_OFF;
  
        __sta_info_flush(sdata, true);
        ieee80211_free_keys(sdata, true);
@@@ -1345,6 -1347,9 +1347,6 @@@ static int sta_apply_parameters(struct 
                                                    params->vht_capa, sta);
  
        if (params->opmode_notif_used) {
 -              enum ieee80211_band band =
 -                      ieee80211_get_sdata_band(sdata);
 -
                /* returned value is only needed for rc update, but the
                 * rc isn't initialized here yet, so ignore it
                 */
@@@ -2662,6 -2667,24 +2664,24 @@@ static int ieee80211_start_roc_work(str
        INIT_DELAYED_WORK(&roc->work, ieee80211_sw_roc_work);
        INIT_LIST_HEAD(&roc->dependents);
  
+       /*
+        * cookie is either the roc cookie (for normal roc)
+        * or the SKB (for mgmt TX)
+        */
+       if (!txskb) {
+               /* local->mtx protects this */
+               local->roc_cookie_counter++;
+               roc->cookie = local->roc_cookie_counter;
+               /* wow, you wrapped 64 bits ... more likely a bug */
+               if (WARN_ON(roc->cookie == 0)) {
+                       roc->cookie = 1;
+                       local->roc_cookie_counter++;
+               }
+               *cookie = roc->cookie;
+       } else {
+               *cookie = (unsigned long)txskb;
+       }
+ 
        /* if there's one pending or we're scanning, queue this one */
        if (!list_empty(&local->roc_list) ||
            local->scanning || local->radar_detect_enabled)
@@@ -2784,24 -2807,6 +2804,6 @@@
        if (!queued)
                list_add_tail(&roc->list, &local->roc_list);
  
-       /*
-        * cookie is either the roc cookie (for normal roc)
-        * or the SKB (for mgmt TX)
-        */
-       if (!txskb) {
-               /* local->mtx protects this */
-               local->roc_cookie_counter++;
-               roc->cookie = local->roc_cookie_counter;
-               /* wow, you wrapped 64 bits ... more likely a bug */
-               if (WARN_ON(roc->cookie == 0)) {
-                       roc->cookie = 1;
-                       local->roc_cookie_counter++;
-               }
-               *cookie = roc->cookie;
-       } else {
-               *cookie = (unsigned long)txskb;
-       }
- 
        return 0;
  }
  

diff --combined net/mac80211/iface.c
index 9db71cf7a665b7e4060cdeb6ecda2145727f1614,96518ad200c4dc47a74ecd8284981c67872351e4..be198f42f1f7ce6b8f47aedef24032fe0f04c4fe
--- 1/net/mac80211/iface.c
--- 2/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@@ -101,8 -101,9 +101,8 @@@ static u32 __ieee80211_idle_on(struct i
  static u32 __ieee80211_recalc_idle(struct ieee80211_local *local,
                                   bool force_active)
  {
 -      bool working = false, scanning, active;
 +      bool working, scanning, active;
        unsigned int led_trig_start = 0, led_trig_stop = 0;
 -      struct ieee80211_roc_work *roc;
  
        lockdep_assert_held(&local->mtx);
  
@@@ -110,8 -111,12 +110,8 @@@
                 !list_empty(&local->chanctx_list) ||
                 local->monitors;
  
 -      if (!local->ops->remain_on_channel) {
 -              list_for_each_entry(roc, &local->roc_list, list) {
 -                      working = true;
 -                      break;
 -              }
 -      }
 +      working = !local->ops->remain_on_channel &&
 +                !list_empty(&local->roc_list);
  
        scanning = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
                   test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);
@@@ -413,20 -418,24 +413,24 @@@ int ieee80211_add_virtual_monitor(struc
                return ret;
        }
  
+       mutex_lock(&local->iflist_mtx);
+       rcu_assign_pointer(local->monitor_sdata, sdata);
+       mutex_unlock(&local->iflist_mtx);
+ 
        mutex_lock(&local->mtx);
        ret = ieee80211_vif_use_channel(sdata, &local->monitor_chandef,
                                        IEEE80211_CHANCTX_EXCLUSIVE);
        mutex_unlock(&local->mtx);
        if (ret) {
+               mutex_lock(&local->iflist_mtx);
+               rcu_assign_pointer(local->monitor_sdata, NULL);
+               mutex_unlock(&local->iflist_mtx);
+               synchronize_net();
                drv_remove_interface(local, sdata);
                kfree(sdata);
                return ret;
        }
  
-       mutex_lock(&local->iflist_mtx);
-       rcu_assign_pointer(local->monitor_sdata, sdata);
-       mutex_unlock(&local->iflist_mtx);
- 
        return 0;
  }
  
@@@ -765,12 -774,19 +769,19 @@@ static void ieee80211_do_stop(struct ie
  
        ieee80211_roc_purge(local, sdata);
  
-       if (sdata->vif.type == NL80211_IFTYPE_STATION)
+       switch (sdata->vif.type) {
+       case NL80211_IFTYPE_STATION:
                ieee80211_mgd_stop(sdata);
- 
-       if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+               break;
+       case NL80211_IFTYPE_ADHOC:
                ieee80211_ibss_stop(sdata);
- 
+               break;
+       case NL80211_IFTYPE_AP:
+               cancel_work_sync(&sdata->u.ap.request_smps_work);
+               break;
+       default:
+               break;
+       }
  
        /*
         * Remove all stations associated with this interface.

diff --combined net/wireless/nl80211.c
index 179786494308580a247f5fe52a487a32cb869555,8e6b6a2d35cb27984aaddb73cdbc462ef3e350f6..058aa0e1a462304e5e414a5f6eb4dfdac0dfa1cf
--- 1/net/wireless/nl80211.c
--- 2/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@@ -1740,9 -1740,10 +1740,10 @@@ static int nl80211_dump_wiphy(struct sk
                                 * We can then retry with the larger buffer.
                                 */
                                if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
-                                   !skb->len &&
+                                   !skb->len && !state->split &&
                                    cb->min_dump_alloc < 4096) {
                                        cb->min_dump_alloc = 4096;
+                                       state->split_start = 0;
                                        rtnl_unlock();
                                        return 1;
                                }
@@@ -5274,7 -5275,7 +5275,7 @@@ static int nl80211_trigger_scan(struct 
        if (!rdev->ops->scan)
                return -EOPNOTSUPP;
  
-       if (rdev->scan_req) {
+       if (rdev->scan_req || rdev->scan_msg) {
                err = -EBUSY;
                goto unlock;
        }
@@@ -5709,8 -5710,8 +5710,8 @@@ static int nl80211_start_sched_scan(str
                request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
        }
  
 -      if (info->attrs[NL80211_ATTR_IE]) {
 -              request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
 +      if (ie_len) {
 +              request->ie_len = ie_len;
                memcpy((void *)request->ie,
                       nla_data(info->attrs[NL80211_ATTR_IE]),
                       request->ie_len);
@@@ -10116,40 -10117,31 +10117,31 @@@ void nl80211_send_scan_start(struct cfg
                                NL80211_MCGRP_SCAN, GFP_KERNEL);
  }
  
- void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
-                           struct wireless_dev *wdev)
+ struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
+                                      struct wireless_dev *wdev, bool aborted)
  {
        struct sk_buff *msg;
  
        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!msg)
-               return;
+               return NULL;
  
        if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
-                                 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
+                                 aborted ? NL80211_CMD_SCAN_ABORTED :
+                                           NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
                nlmsg_free(msg);
-               return;
+               return NULL;
        }
  
-       genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                               NL80211_MCGRP_SCAN, GFP_KERNEL);
+       return msg;
  }
  
- void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
-                              struct wireless_dev *wdev)
+ void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
+                             struct sk_buff *msg)
  {
-       struct sk_buff *msg;
- 
-       msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!msg)
                return;
  
-       if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
-                                 NL80211_CMD_SCAN_ABORTED) < 0) {
-               nlmsg_free(msg);
-               return;
-       }
- 
        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
                                NL80211_MCGRP_SCAN, GFP_KERNEL);
  }