]> git.kernelconcepts.de Git - karo-tx-linux.git/commitdiff
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wirel...
authorJohn W. Linville <linville@tuxdriver.com>
Wed, 18 Apr 2012 18:17:13 +0000 (14:17 -0400)
committerJohn W. Linville <linville@tuxdriver.com>
Wed, 18 Apr 2012 18:27:48 +0000 (14:27 -0400)
Conflicts:
drivers/net/wireless/iwlwifi/iwl-testmode.c
include/net/nfc/nfc.h
net/nfc/netlink.c
net/wireless/nl80211.c

1  2 
MAINTAINERS
drivers/net/wireless/ipw2x00/ipw2100.c
drivers/net/wireless/ipw2x00/ipw2200.c
drivers/net/wireless/iwlwifi/iwl-testmode.c
drivers/net/wireless/mac80211_hwsim.c
drivers/net/wireless/ti/wlcore/testmode.c
include/net/nfc/nfc.h
net/nfc/core.c
net/nfc/netlink.c
net/nfc/nfc.h
net/wireless/nl80211.c

diff --combined MAINTAINERS
index f1b5694340f4ff655c774db5c66116ed3a1bb3b3,fa96459fa01f12d775730f5138e8402b0a8cb8e0..250f59cc9d3cc2484d63d63c015b710de63c0cc7
@@@ -228,7 -228,7 +228,7 @@@ M: Len Brown <lenb@kernel.org
  L:    linux-acpi@vger.kernel.org
  W:    http://www.lesswatts.org/projects/acpi/
  Q:    http://patchwork.kernel.org/project/linux-acpi/list/
 -T:    git git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6.git
 +T:    git git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux
  S:    Supported
  F:    drivers/acpi/
  F:    drivers/pnp/pnpacpi/
@@@ -1431,7 -1431,6 +1431,7 @@@ F:      include/linux/backlight.
  BATMAN ADVANCED
  M:    Marek Lindner <lindner_marek@yahoo.de>
  M:    Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
 +M:    Antonio Quartulli <ordex@autistici.org>
  L:    b.a.t.m.a.n@lists.open-mesh.org
  W:    http://www.open-mesh.org/
  S:    Maintained
@@@ -2451,17 -2450,17 +2451,17 @@@ F:   fs/ecryptfs
  
  EDAC-CORE
  M:    Doug Thompson <dougthompson@xmission.com>
 -L:    bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
 +L:    linux-edac@vger.kernel.org
  W:    bluesmoke.sourceforge.net
  S:    Supported
  F:    Documentation/edac.txt
 -F:    drivers/edac/edac_*
 +F:    drivers/edac/
  F:    include/linux/edac.h
  
  EDAC-AMD64
  M:    Doug Thompson <dougthompson@xmission.com>
  M:    Borislav Petkov <borislav.petkov@amd.com>
 -L:    bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
 +L:    linux-edac@vger.kernel.org
  W:    bluesmoke.sourceforge.net
  S:    Supported
  F:    drivers/edac/amd64_edac*
  EDAC-E752X
  M:    Mark Gross <mark.gross@intel.com>
  M:    Doug Thompson <dougthompson@xmission.com>
 -L:    bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
 +L:    linux-edac@vger.kernel.org
  W:    bluesmoke.sourceforge.net
  S:    Maintained
  F:    drivers/edac/e752x_edac.c
  
  EDAC-E7XXX
  M:    Doug Thompson <dougthompson@xmission.com>
 -L:    bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
 +L:    linux-edac@vger.kernel.org
  W:    bluesmoke.sourceforge.net
  S:    Maintained
  F:    drivers/edac/e7xxx_edac.c
  
  EDAC-I82443BXGX
  M:    Tim Small <tim@buttersideup.com>
 -L:    bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
 +L:    linux-edac@vger.kernel.org
  W:    bluesmoke.sourceforge.net
  S:    Maintained
  F:    drivers/edac/i82443bxgx_edac.c
  
  EDAC-I3000
  M:    Jason Uhlenkott <juhlenko@akamai.com>
 -L:    bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
 +L:    linux-edac@vger.kernel.org
  W:    bluesmoke.sourceforge.net
  S:    Maintained
  F:    drivers/edac/i3000_edac.c
  
  EDAC-I5000
  M:    Doug Thompson <dougthompson@xmission.com>
 -L:    bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
 +L:    linux-edac@vger.kernel.org
  W:    bluesmoke.sourceforge.net
  S:    Maintained
  F:    drivers/edac/i5000_edac.c
@@@ -2526,21 -2525,21 +2526,21 @@@ F:   drivers/edac/i7core_edac.
  EDAC-I82975X
  M:    Ranganathan Desikan <ravi@jetztechnologies.com>
  M:    "Arvind R." <arvino55@gmail.com>
 -L:    bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
 +L:    linux-edac@vger.kernel.org
  W:    bluesmoke.sourceforge.net
  S:    Maintained
  F:    drivers/edac/i82975x_edac.c
  
  EDAC-PASEMI
  M:    Egor Martovetsky <egor@pasemi.com>
 -L:    bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
 +L:    linux-edac@vger.kernel.org
  W:    bluesmoke.sourceforge.net
  S:    Maintained
  F:    drivers/edac/pasemi_edac.c
  
  EDAC-R82600
  M:    Tim Small <tim@buttersideup.com>
 -L:    bluesmoke-devel@lists.sourceforge.net (moderated for non-subscribers)
 +L:    linux-edac@vger.kernel.org
  W:    bluesmoke.sourceforge.net
  S:    Maintained
  F:    drivers/edac/r82600_edac.c
@@@ -3520,6 -3519,12 +3520,6 @@@ M:     Deepak Saxena <dsaxena@plexity.net
  S:    Maintained
  F:    drivers/char/hw_random/ixp4xx-rng.c
  
 -INTEL IXP2000 ETHERNET DRIVER
 -M:    Lennert Buytenhek <kernel@wantstofly.org>
 -L:    netdev@vger.kernel.org
 -S:    Maintained
 -F:    drivers/net/ethernet/xscale/ixp2000/
 -
  INTEL ETHERNET DRIVERS (e100/e1000/e1000e/igb/igbvf/ixgb/ixgbe/ixgbevf)
  M:    Jeff Kirsher <jeffrey.t.kirsher@intel.com>
  M:    Jesse Brandeburg <jesse.brandeburg@intel.com>
@@@ -4528,7 -4533,8 +4528,7 @@@ S:      Supporte
  F:    drivers/net/ethernet/myricom/myri10ge/
  
  NATSEMI ETHERNET DRIVER (DP8381x)
 -M:    Tim Hockin <thockin@hockin.org>
 -S:    Maintained
 +S:    Orphan
  F:    drivers/net/ethernet/natsemi/natsemi.c
  
  NATIVE INSTRUMENTS USB SOUND INTERFACE DRIVER
@@@ -4797,7 -4803,6 +4797,7 @@@ F:      arch/arm/mach-omap2/clockdomain2xxx_
  F:    arch/arm/mach-omap2/clockdomain44xx.c
  
  OMAP AUDIO SUPPORT
 +M:    Peter Ujfalusi <peter.ujfalusi@ti.com>
  M:    Jarkko Nikula <jarkko.nikula@bitmer.com>
  L:    alsa-devel@alsa-project.org (subscribers-only)
  L:    linux-omap@vger.kernel.org
@@@ -5112,11 -5117,6 +5112,11 @@@ F:    drivers/i2c/busses/i2c-pca-
  F:    include/linux/i2c-algo-pca.h
  F:    include/linux/i2c-pca-platform.h
  
 +PCDP - PRIMARY CONSOLE AND DEBUG PORT
 +M:    Khalid Aziz <khalid.aziz@hp.com>
 +S:    Maintained
 +F:    drivers/firmware/pcdp.*
 +
  PCI ERROR RECOVERY
  M:     Linas Vepstas <linasvepstas@gmail.com>
  L:    linux-pci@vger.kernel.org
@@@ -5202,7 -5202,7 +5202,7 @@@ S:      Maintaine
  F:    include/linux/personality.h
  
  PHONET PROTOCOL
 -M:    Remi Denis-Courmont <remi.denis-courmont@nokia.com>
 +M:    Remi Denis-Courmont <courmisch@gmail.com>
  S:    Supported
  F:    Documentation/networking/phonet.txt
  F:    include/linux/phonet.h
@@@ -6669,6 -6669,16 +6669,16 @@@ L:    alsa-devel@alsa-project.org (moderat
  S:    Maintained
  F:    sound/soc/codecs/twl4030*
  
+ TI WILINK WIRELESS DRIVERS
+ M:    Luciano Coelho <coelho@ti.com>
+ L:    linux-wireless@vger.kernel.org
+ W:    http://wireless.kernel.org/en/users/Drivers/wl12xx
+ W:    http://wireless.kernel.org/en/users/Drivers/wl1251
+ T:    git git://git.kernel.org/pub/scm/linux/kernel/git/luca/wl12xx.git
+ S:    Maintained
+ F:    drivers/net/wireless/ti/
+ F:    include/linux/wl12xx.h
  TIPC NETWORK LAYER
  M:    Jon Maloy <jon.maloy@ericsson.com>
  M:    Allan Stephens <allan.stephens@windriver.com>
@@@ -7425,23 -7435,6 +7435,6 @@@ M:     Miloslav Trmac <mitr@volny.cz
  S:    Maintained
  F:    drivers/input/misc/wistron_btns.c
  
- WL1251 WIRELESS DRIVER
- M:    Luciano Coelho <coelho@ti.com>
- L:    linux-wireless@vger.kernel.org
- W:    http://wireless.kernel.org/en/users/Drivers/wl1251
- T:    git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-testing.git
- S:    Maintained
- F:    drivers/net/wireless/wl1251/*
- WL1271 WIRELESS DRIVER
- M:    Luciano Coelho <coelho@ti.com>
- L:    linux-wireless@vger.kernel.org
- W:    http://wireless.kernel.org/en/users/Drivers/wl12xx
- T:    git git://git.kernel.org/pub/scm/linux/kernel/git/luca/wl12xx.git
- S:    Maintained
- F:    drivers/net/wireless/wl12xx/
- F:    include/linux/wl12xx.h
  WL3501 WIRELESS PCMCIA CARD DRIVER
  M:    Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
  L:    linux-wireless@vger.kernel.org
@@@ -7461,7 -7454,8 +7454,7 @@@ F:      include/linux/wm97xx.
  
  WOLFSON MICROELECTRONICS DRIVERS
  M:    Mark Brown <broonie@opensource.wolfsonmicro.com>
 -M:    Ian Lartey <ian@opensource.wolfsonmicro.com>
 -M:    Dimitris Papastamos <dp@opensource.wolfsonmicro.com>
 +L:    patches@opensource.wolfsonmicro.com
  T:    git git://opensource.wolfsonmicro.com/linux-2.6-asoc
  T:    git git://opensource.wolfsonmicro.com/linux-2.6-audioplus
  W:    http://opensource.wolfsonmicro.com/content/linux-drivers-wolfson-devices
@@@ -7572,8 -7566,8 +7565,8 @@@ F:      Documentation/filesystems/xfs.tx
  F:    fs/xfs/
  
  XILINX AXI ETHERNET DRIVER
 -M:    Ariane Keller <ariane.keller@tik.ee.ethz.ch>
 -M:    Daniel Borkmann <daniel.borkmann@tik.ee.ethz.ch>
 +M:    Anirudha Sarangi <anirudh@xilinx.com>
 +M:    John Linn <John.Linn@xilinx.com>
  S:    Maintained
  F:    drivers/net/ethernet/xilinx/xilinx_axienet*
  
index 2662d46134d0538d4673e405c96c1bf6f972f9e4,8193687883193a5f5776b308d12e1c12add8f8c3..c72136c0777439bbe84f5bd7a27e25d96e5cd821
@@@ -166,6 -166,7 +166,7 @@@ that only one external action is invoke
  #include <net/lib80211.h>
  
  #include "ipw2100.h"
+ #include "ipw.h"
  
  #define IPW2100_VERSION "git-1.2.2"
  
@@@ -343,50 -344,38 +344,50 @@@ static struct iw_handler_def ipw2100_wx
  
  static inline void read_register(struct net_device *dev, u32 reg, u32 * val)
  {
 -      *val = readl((void __iomem *)(dev->base_addr + reg));
 +      struct ipw2100_priv *priv = libipw_priv(dev);
 +
 +      *val = ioread32(priv->ioaddr + reg);
        IPW_DEBUG_IO("r: 0x%08X => 0x%08X\n", reg, *val);
  }
  
  static inline void write_register(struct net_device *dev, u32 reg, u32 val)
  {
 -      writel(val, (void __iomem *)(dev->base_addr + reg));
 +      struct ipw2100_priv *priv = libipw_priv(dev);
 +
 +      iowrite32(val, priv->ioaddr + reg);
        IPW_DEBUG_IO("w: 0x%08X <= 0x%08X\n", reg, val);
  }
  
  static inline void read_register_word(struct net_device *dev, u32 reg,
                                      u16 * val)
  {
 -      *val = readw((void __iomem *)(dev->base_addr + reg));
 +      struct ipw2100_priv *priv = libipw_priv(dev);
 +
 +      *val = ioread16(priv->ioaddr + reg);
        IPW_DEBUG_IO("r: 0x%08X => %04X\n", reg, *val);
  }
  
  static inline void read_register_byte(struct net_device *dev, u32 reg, u8 * val)
  {
 -      *val = readb((void __iomem *)(dev->base_addr + reg));
 +      struct ipw2100_priv *priv = libipw_priv(dev);
 +
 +      *val = ioread8(priv->ioaddr + reg);
        IPW_DEBUG_IO("r: 0x%08X => %02X\n", reg, *val);
  }
  
  static inline void write_register_word(struct net_device *dev, u32 reg, u16 val)
  {
 -      writew(val, (void __iomem *)(dev->base_addr + reg));
 +      struct ipw2100_priv *priv = libipw_priv(dev);
 +
 +      iowrite16(val, priv->ioaddr + reg);
        IPW_DEBUG_IO("w: 0x%08X <= %04X\n", reg, val);
  }
  
  static inline void write_register_byte(struct net_device *dev, u32 reg, u8 val)
  {
 -      writeb(val, (void __iomem *)(dev->base_addr + reg));
 +      struct ipw2100_priv *priv = libipw_priv(dev);
 +
 +      iowrite8(val, priv->ioaddr + reg);
        IPW_DEBUG_IO("w: 0x%08X =< %02X\n", reg, val);
  }
  
@@@ -518,13 -507,13 +519,13 @@@ static void read_nic_memory(struct net_
                read_register_byte(dev, IPW_REG_INDIRECT_ACCESS_DATA + i, buf);
  }
  
 -static inline int ipw2100_hw_is_adapter_in_system(struct net_device *dev)
 +static bool ipw2100_hw_is_adapter_in_system(struct net_device *dev)
  {
 -      return (dev->base_addr &&
 -              (readl
 -               ((void __iomem *)(dev->base_addr +
 -                                 IPW_REG_DOA_DEBUG_AREA_START))
 -               == IPW_DATA_DOA_DEBUG_VALUE));
 +      u32 dbg;
 +
 +      read_register(dev, IPW_REG_DOA_DEBUG_AREA_START, &dbg);
 +
 +      return dbg == IPW_DATA_DOA_DEBUG_VALUE;
  }
  
  static int ipw2100_get_ordinal(struct ipw2100_priv *priv, u32 ord,
@@@ -1958,6 -1947,9 +1959,9 @@@ static int ipw2100_wdev_init(struct net
                wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = bg_band;
        }
  
+       wdev->wiphy->cipher_suites = ipw_cipher_suites;
+       wdev->wiphy->n_cipher_suites = ARRAY_SIZE(ipw_cipher_suites);
        set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
        if (wiphy_register(wdev->wiphy)) {
                ipw2100_down(priv);
@@@ -3785,7 -3777,7 +3789,7 @@@ IPW2100_ORD(STAT_TX_HOST_REQUESTS, "req
            IPW2100_ORD(COUNTRY_CODE,
                                "IEEE country code as recv'd from beacon"),
            IPW2100_ORD(COUNTRY_CHANNELS,
 -                              "channels suported by country"),
 +                              "channels supported by country"),
            IPW2100_ORD(RESET_CNT, "adapter resets (warm)"),
            IPW2100_ORD(BEACON_INTERVAL, "Beacon interval"),
            IPW2100_ORD(ANTENNA_DIVERSITY,
@@@ -4074,7 -4066,7 +4078,7 @@@ static int ipw2100_switch_mode(struct i
        ipw2100_firmware.version = 0;
  #endif
  
 -      printk(KERN_INFO "%s: Reseting on mode change.\n", priv->net_dev->name);
 +      printk(KERN_INFO "%s: Resetting on mode change.\n", priv->net_dev->name);
        priv->reset_backoff = 0;
        schedule_reset(priv);
  
@@@ -6094,7 -6086,9 +6098,7 @@@ static const struct net_device_ops ipw2
  /* Look into using netdev destructor to shutdown libipw? */
  
  static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
 -                                             void __iomem * base_addr,
 -                                             unsigned long mem_start,
 -                                             unsigned long mem_len)
 +                                             void __iomem * ioaddr)
  {
        struct ipw2100_priv *priv;
        struct net_device *dev;
        priv->ieee = netdev_priv(dev);
        priv->pci_dev = pci_dev;
        priv->net_dev = dev;
 +      priv->ioaddr = ioaddr;
  
        priv->ieee->hard_start_xmit = ipw2100_tx;
        priv->ieee->set_security = shim__set_security;
        dev->watchdog_timeo = 3 * HZ;
        dev->irq = 0;
  
 -      dev->base_addr = (unsigned long)base_addr;
 -      dev->mem_start = mem_start;
 -      dev->mem_end = dev->mem_start + mem_len - 1;
 -
        /* NOTE: We don't use the wireless_handlers hook
         * in dev as the system will start throwing WX requests
         * to us before we're actually initialized and it just
  static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
                                const struct pci_device_id *ent)
  {
 -      unsigned long mem_start, mem_len, mem_flags;
 -      void __iomem *base_addr = NULL;
 +      void __iomem *ioaddr;
        struct net_device *dev = NULL;
        struct ipw2100_priv *priv = NULL;
        int err = 0;
  
        IPW_DEBUG_INFO("enter\n");
  
 -      mem_start = pci_resource_start(pci_dev, 0);
 -      mem_len = pci_resource_len(pci_dev, 0);
 -      mem_flags = pci_resource_flags(pci_dev, 0);
 -
 -      if ((mem_flags & IORESOURCE_MEM) != IORESOURCE_MEM) {
 +      if (!(pci_resource_flags(pci_dev, 0) & IORESOURCE_MEM)) {
                IPW_DEBUG_INFO("weird - resource type is not memory\n");
                err = -ENODEV;
 -              goto fail;
 +              goto out;
        }
  
 -      base_addr = ioremap_nocache(mem_start, mem_len);
 -      if (!base_addr) {
 +      ioaddr = pci_iomap(pci_dev, 0, 0);
 +      if (!ioaddr) {
                printk(KERN_WARNING DRV_NAME
                       "Error calling ioremap_nocache.\n");
                err = -EIO;
        }
  
        /* allocate and initialize our net_device */
 -      dev = ipw2100_alloc_device(pci_dev, base_addr, mem_start, mem_len);
 +      dev = ipw2100_alloc_device(pci_dev, ioaddr);
        if (!dev) {
                printk(KERN_WARNING DRV_NAME
                       "Error calling ipw2100_alloc_device.\n");
        priv->status |= STATUS_INITIALIZED;
  
        mutex_unlock(&priv->action_mutex);
 -
 -      return 0;
 +out:
 +      return err;
  
        fail_unlock:
        mutex_unlock(&priv->action_mutex);
                pci_set_drvdata(pci_dev, NULL);
        }
  
 -      if (base_addr)
 -              iounmap(base_addr);
 +      pci_iounmap(pci_dev, ioaddr);
  
        pci_release_regions(pci_dev);
        pci_disable_device(pci_dev);
 -
 -      return err;
 +      goto out;
  }
  
  static void __devexit ipw2100_pci_remove_one(struct pci_dev *pci_dev)
  {
        struct ipw2100_priv *priv = pci_get_drvdata(pci_dev);
 -      struct net_device *dev;
 +      struct net_device *dev = priv->net_dev;
  
 -      if (priv) {
 -              mutex_lock(&priv->action_mutex);
 +      mutex_lock(&priv->action_mutex);
  
 -              priv->status &= ~STATUS_INITIALIZED;
 +      priv->status &= ~STATUS_INITIALIZED;
  
 -              dev = priv->net_dev;
 -              sysfs_remove_group(&pci_dev->dev.kobj,
 -                                 &ipw2100_attribute_group);
 +      sysfs_remove_group(&pci_dev->dev.kobj, &ipw2100_attribute_group);
  
  #ifdef CONFIG_PM
 -              if (ipw2100_firmware.version)
 -                      ipw2100_release_firmware(priv, &ipw2100_firmware);
 +      if (ipw2100_firmware.version)
 +              ipw2100_release_firmware(priv, &ipw2100_firmware);
  #endif
 -              /* Take down the hardware */
 -              ipw2100_down(priv);
 +      /* Take down the hardware */
 +      ipw2100_down(priv);
  
 -              /* Release the mutex so that the network subsystem can
 -               * complete any needed calls into the driver... */
 -              mutex_unlock(&priv->action_mutex);
 +      /* Release the mutex so that the network subsystem can
 +       * complete any needed calls into the driver... */
 +      mutex_unlock(&priv->action_mutex);
  
 -              /* Unregister the device first - this results in close()
 -               * being called if the device is open.  If we free storage
 -               * first, then close() will crash. */
 -              unregister_netdev(dev);
 +      /* Unregister the device first - this results in close()
 +       * being called if the device is open.  If we free storage
 +       * first, then close() will crash.
 +       * FIXME: remove the comment above. */
 +      unregister_netdev(dev);
  
 -              ipw2100_kill_works(priv);
 +      ipw2100_kill_works(priv);
  
 -              ipw2100_queues_free(priv);
 +      ipw2100_queues_free(priv);
  
 -              /* Free potential debugging firmware snapshot */
 -              ipw2100_snapshot_free(priv);
 +      /* Free potential debugging firmware snapshot */
 +      ipw2100_snapshot_free(priv);
  
 -              if (dev->irq)
 -                      free_irq(dev->irq, priv);
 +      free_irq(dev->irq, priv);
  
 -              if (dev->base_addr)
 -                      iounmap((void __iomem *)dev->base_addr);
 +      pci_iounmap(pci_dev, priv->ioaddr);
  
 -              /* wiphy_unregister needs to be here, before free_libipw */
 -              wiphy_unregister(priv->ieee->wdev.wiphy);
 -              kfree(priv->ieee->bg_band.channels);
 -              free_libipw(dev, 0);
 -      }
 +      /* wiphy_unregister needs to be here, before free_libipw */
 +      wiphy_unregister(priv->ieee->wdev.wiphy);
 +      kfree(priv->ieee->bg_band.channels);
 +      free_libipw(dev, 0);
  
        pci_release_regions(pci_dev);
        pci_disable_device(pci_dev);
@@@ -8503,8 -8512,7 +8507,7 @@@ static void ipw2100_release_firmware(st
                                     struct ipw2100_fw *fw)
  {
        fw->version = 0;
-       if (fw->fw_entry)
-               release_firmware(fw->fw_entry);
+       release_firmware(fw->fw_entry);
        fw->fw_entry = NULL;
  }
  
@@@ -8604,7 -8612,7 +8607,7 @@@ static int ipw2100_ucode_download(struc
        struct net_device *dev = priv->net_dev;
        const unsigned char *microcode_data = fw->uc.data;
        unsigned int microcode_data_left = fw->uc.size;
 -      void __iomem *reg = (void __iomem *)dev->base_addr;
 +      void __iomem *reg = priv->ioaddr;
  
        struct symbol_alive_response response;
        int i, j;
index 809b7a70974b490b114b633bc3ac2dedbcc44081,f37d315f942f7a9e93a099678f6bfeb5fb325f3a..d57522c64073463763d619edc6162a381d27f668
@@@ -34,6 -34,7 +34,7 @@@
  #include <linux/slab.h>
  #include <net/cfg80211-wext.h>
  #include "ipw2200.h"
+ #include "ipw.h"
  
  
  #ifndef KBUILD_EXTMOD
@@@ -3657,8 -3658,7 +3658,7 @@@ static int ipw_load(struct ipw_priv *pr
                priv->rxq = NULL;
        }
        ipw_tx_queue_free(priv);
-       if (raw)
-               release_firmware(raw);
+       release_firmware(raw);
  #ifdef CONFIG_PM
        fw_loaded = 0;
        raw = NULL;
@@@ -7024,7 -7024,7 +7024,7 @@@ static int ipw_qos_activate(struct ipw_
                            cpu_to_le16(burst_duration);
        } else if (priv->ieee->iw_mode == IW_MODE_ADHOC) {
                if (type == IEEE_B) {
 -                      IPW_DEBUG_QOS("QoS activate IBSS nework mode %d\n",
 +                      IPW_DEBUG_QOS("QoS activate IBSS network mode %d\n",
                                      type);
                        if (priv->qos_data.qos_enable == 0)
                                active_one = &def_parameters_CCK;
@@@ -11533,6 -11533,9 +11533,9 @@@ static int ipw_wdev_init(struct net_dev
                wdev->wiphy->bands[IEEE80211_BAND_5GHZ] = a_band;
        }
  
+       wdev->wiphy->cipher_suites = ipw_cipher_suites;
+       wdev->wiphy->n_cipher_suites = ARRAY_SIZE(ipw_cipher_suites);
        set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
  
        /* With that information in place, we can now register the wiphy... */
@@@ -11826,6 -11829,10 +11829,6 @@@ static int __devinit ipw_pci_probe(stru
        net_dev->wireless_data = &priv->wireless_data;
        net_dev->wireless_handlers = &ipw_wx_handler_def;
        net_dev->ethtool_ops = &ipw_ethtool_ops;
 -      net_dev->irq = pdev->irq;
 -      net_dev->base_addr = (unsigned long)priv->hw_base;
 -      net_dev->mem_start = pci_resource_start(pdev, 0);
 -      net_dev->mem_end = net_dev->mem_start + pci_resource_len(pdev, 0) - 1;
  
        err = sysfs_create_group(&pdev->dev.kobj, &ipw_attribute_group);
        if (err) {
index f31a0629c6c672bf2c3c8f5502d2ec18d7299e4a,c8e89cac7ea32a06e574cc118418accef16dbf0f..bb275098bb108869085b414dccf9b06e9dc96b49
@@@ -184,10 -184,9 +184,10 @@@ static void iwl_testmode_ucode_rx_pkt(s
                         "Run out of memory for messages to user space ?\n");
                return;
        }
 -      NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT);
 -      /* the length doesn't include len_n_flags field, so add it manually */
 -      NLA_PUT(skb, IWL_TM_ATTR_UCODE_RX_PKT, length + sizeof(__le32), data);
 +      if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT) ||
 +          /* the length doesn't include len_n_flags field, so add it manually */
 +          nla_put(skb, IWL_TM_ATTR_UCODE_RX_PKT, length + sizeof(__le32), data))
 +              goto nla_put_failure;
        cfg80211_testmode_event(skb, GFP_ATOMIC);
        return;
  
@@@ -315,9 -314,8 +315,9 @@@ static int iwl_testmode_ucode(struct ie
        memcpy(reply_buf, &(pkt->hdr), reply_len);
        iwl_free_resp(&cmd);
  
 -      NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT);
 -      NLA_PUT(skb, IWL_TM_ATTR_UCODE_RX_PKT, reply_len, reply_buf);
 +      if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT) ||
 +          nla_put(skb, IWL_TM_ATTR_UCODE_RX_PKT, reply_len, reply_buf))
 +              goto nla_put_failure;
        return cfg80211_testmode_reply(skb);
  
  nla_put_failure:
@@@ -381,8 -379,7 +381,8 @@@ static int iwl_testmode_reg(struct ieee
                        IWL_ERR(priv, "Memory allocation fail\n");
                        return -ENOMEM;
                }
 -              NLA_PUT_U32(skb, IWL_TM_ATTR_REG_VALUE32, val32);
 +              if (nla_put_u32(skb, IWL_TM_ATTR_REG_VALUE32, val32))
 +                      goto nla_put_failure;
                status = cfg80211_testmode_reply(skb);
                if (status < 0)
                        IWL_ERR(priv, "Error sending msg : %d\n", status);
@@@ -484,11 -481,10 +484,11 @@@ static int iwl_testmode_driver(struct i
                        IWL_ERR(priv, "Memory allocation fail\n");
                        return -ENOMEM;
                }
 -              NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 -                          IWL_TM_CMD_DEV2APP_SYNC_RSP);
 -              NLA_PUT(skb, IWL_TM_ATTR_SYNC_RSP,
 -                      rsp_data_len, rsp_data_ptr);
 +              if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
 +                              IWL_TM_CMD_DEV2APP_SYNC_RSP) ||
 +                  nla_put(skb, IWL_TM_ATTR_SYNC_RSP,
 +                          rsp_data_len, rsp_data_ptr))
 +                      goto nla_put_failure;
                status = cfg80211_testmode_reply(skb);
                if (status < 0)
                        IWL_ERR(priv, "Error sending msg : %d\n", status);
                break;
  
        case IWL_TM_CMD_APP2DEV_GET_EEPROM:
-               if (priv->shrd->eeprom) {
+               if (priv->eeprom) {
                        skb = cfg80211_testmode_alloc_reply_skb(hw->wiphy,
                                cfg(priv)->base_params->eeprom_size + 20);
                        if (!skb) {
                                IWL_ERR(priv, "Memory allocation fail\n");
                                return -ENOMEM;
                        }
 -                      NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND,
 -                              IWL_TM_CMD_DEV2APP_EEPROM_RSP);
 -                      NLA_PUT(skb, IWL_TM_ATTR_EEPROM,
 -                              cfg(priv)->base_params->eeprom_size,
 -                              priv->eeprom);
 +                      if (nla_put_u32(skb, IWL_TM_ATTR_COMMAND,
 +                                      IWL_TM_CMD_DEV2APP_EEPROM_RSP) ||
 +                          nla_put(skb, IWL_TM_ATTR_EEPROM,
 +                                  cfg(priv)->base_params->eeprom_size,
-                                   priv->shrd->eeprom))
++                                  priv->eeprom))
 +                              goto nla_put_failure;
                        status = cfg80211_testmode_reply(skb);
                        if (status < 0)
                                IWL_ERR(priv, "Error sending msg : %d\n",
                        IWL_ERR(priv, "Memory allocation fail\n");
                        return -ENOMEM;
                }
 -              NLA_PUT_U32(skb, IWL_TM_ATTR_FW_VERSION,
 -                          priv->fw->ucode_ver);
 +              if (nla_put_u32(skb, IWL_TM_ATTR_FW_VERSION,
 +                              priv->fw->ucode_ver))
 +                      goto nla_put_failure;
                status = cfg80211_testmode_reply(skb);
                if (status < 0)
                        IWL_ERR(priv, "Error sending msg : %d\n", status);
                        IWL_ERR(priv, "Memory allocation fail\n");
                        return -ENOMEM;
                }
 -              NLA_PUT_U32(skb, IWL_TM_ATTR_DEVICE_ID, devid);
 +              if (nla_put_u32(skb, IWL_TM_ATTR_DEVICE_ID, devid))
 +                      goto nla_put_failure;
                status = cfg80211_testmode_reply(skb);
                if (status < 0)
                        IWL_ERR(priv, "Error sending msg : %d\n", status);
                        inst_size = img->sec[IWL_UCODE_SECTION_INST].len;
                        data_size = img->sec[IWL_UCODE_SECTION_DATA].len;
                }
 -              NLA_PUT_U32(skb, IWL_TM_ATTR_FW_TYPE, priv->cur_ucode);
 -              NLA_PUT_U32(skb, IWL_TM_ATTR_FW_INST_SIZE, inst_size);
 -              NLA_PUT_U32(skb, IWL_TM_ATTR_FW_DATA_SIZE, data_size);
 +              if (nla_put_u32(skb, IWL_TM_ATTR_FW_TYPE, priv->cur_ucode) ||
 +                  nla_put_u32(skb, IWL_TM_ATTR_FW_INST_SIZE, inst_size) ||
 +                  nla_put_u32(skb, IWL_TM_ATTR_FW_DATA_SIZE, data_size))
 +                      goto nla_put_failure;
                status = cfg80211_testmode_reply(skb);
                if (status < 0)
                        IWL_ERR(priv, "Error sending msg : %d\n", status);
@@@ -689,10 -681,9 +689,10 @@@ static int iwl_testmode_trace(struct ie
                        iwl_trace_cleanup(priv);
                        return -ENOMEM;
                }
 -              NLA_PUT(skb, IWL_TM_ATTR_TRACE_ADDR,
 -                      sizeof(priv->testmode_trace.dma_addr),
 -                      (u64 *)&priv->testmode_trace.dma_addr);
 +              if (nla_put(skb, IWL_TM_ATTR_TRACE_ADDR,
 +                          sizeof(priv->testmode_trace.dma_addr),
 +                          (u64 *)&priv->testmode_trace.dma_addr))
 +                      goto nla_put_failure;
                status = cfg80211_testmode_reply(skb);
                if (status < 0) {
                        IWL_ERR(priv, "Error sending msg : %d\n", status);
@@@ -737,10 -728,9 +737,10 @@@ static int iwl_testmode_trace_dump(stru
                        length = priv->testmode_trace.buff_size %
                                DUMP_CHUNK_SIZE;
  
 -              NLA_PUT(skb, IWL_TM_ATTR_TRACE_DUMP, length,
 -                      priv->testmode_trace.trace_addr +
 -                      (DUMP_CHUNK_SIZE * idx));
 +              if (nla_put(skb, IWL_TM_ATTR_TRACE_DUMP, length,
 +                          priv->testmode_trace.trace_addr +
 +                          (DUMP_CHUNK_SIZE * idx)))
 +                      goto nla_put_failure;
                idx++;
                cb->args[4] = idx;
                return 0;
@@@ -935,10 -925,9 +935,10 @@@ static int iwl_testmode_buffer_dump(str
                        length = priv->testmode_mem.buff_size %
                                DUMP_CHUNK_SIZE;
  
 -              NLA_PUT(skb, IWL_TM_ATTR_BUFFER_DUMP, length,
 -                      priv->testmode_mem.buff_addr +
 -                      (DUMP_CHUNK_SIZE * idx));
 +              if (nla_put(skb, IWL_TM_ATTR_BUFFER_DUMP, length,
 +                          priv->testmode_mem.buff_addr +
 +                          (DUMP_CHUNK_SIZE * idx)))
 +                      goto nla_put_failure;
                idx++;
                cb->args[4] = idx;
                return 0;
index 2d913644d92b5d202a065dd55f1c6dab58bcdaca,3edd473d8acdda616333f5880ff75fb59e3e9bfd..03c0c6b1372ca8cf68e1b464efdf376b8603ed06
@@@ -582,13 -582,11 +582,13 @@@ static void mac80211_hwsim_tx_frame_nl(
                goto nla_put_failure;
        }
  
 -      NLA_PUT(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
 -                   sizeof(struct mac_address), data->addresses[1].addr);
 +      if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
 +                  sizeof(struct mac_address), data->addresses[1].addr))
 +              goto nla_put_failure;
  
        /* We get the skb->data */
 -      NLA_PUT(skb, HWSIM_ATTR_FRAME, my_skb->len, my_skb->data);
 +      if (nla_put(skb, HWSIM_ATTR_FRAME, my_skb->len, my_skb->data))
 +              goto nla_put_failure;
  
        /* We get the flags for this transmission, and we translate them to
           wmediumd flags  */
        if (info->flags & IEEE80211_TX_CTL_NO_ACK)
                hwsim_flags |= HWSIM_TX_CTL_NO_ACK;
  
 -      NLA_PUT_U32(skb, HWSIM_ATTR_FLAGS, hwsim_flags);
 +      if (nla_put_u32(skb, HWSIM_ATTR_FLAGS, hwsim_flags))
 +              goto nla_put_failure;
  
        /* We get the tx control (rate and retries) info*/
  
                tx_attempts[i].count = info->status.rates[i].count;
        }
  
 -      NLA_PUT(skb, HWSIM_ATTR_TX_INFO,
 -                   sizeof(struct hwsim_tx_rate)*IEEE80211_TX_MAX_RATES,
 -                   tx_attempts);
 +      if (nla_put(skb, HWSIM_ATTR_TX_INFO,
 +                  sizeof(struct hwsim_tx_rate)*IEEE80211_TX_MAX_RATES,
 +                  tx_attempts))
 +              goto nla_put_failure;
  
        /* We create a cookie to identify this skb */
 -      NLA_PUT_U64(skb, HWSIM_ATTR_COOKIE, (unsigned long) my_skb);
 +      if (nla_put_u64(skb, HWSIM_ATTR_COOKIE, (unsigned long) my_skb))
 +              goto nla_put_failure;
  
        genlmsg_end(skb, msg_head);
        genlmsg_unicast(&init_net, skb, dst_pid);
@@@ -699,6 -694,7 +699,7 @@@ static bool mac80211_hwsim_tx_frame_no_
                    ieee80211_is_probe_resp(mgmt->frame_control))
                        mgmt->u.beacon.timestamp = cpu_to_le64(
                                rx_status.mactime +
+                               (data->tsf_offset - data2->tsf_offset) +
                                24 * 8 * 10 / txrate->bitrate);
  
                memcpy(IEEE80211_SKB_RXCB(nskb), &rx_status, sizeof(rx_status));
@@@ -1113,8 -1109,7 +1114,8 @@@ static int mac80211_hwsim_testmode_cmd(
                                                nla_total_size(sizeof(u32)));
                if (!skb)
                        return -ENOMEM;
 -              NLA_PUT_U32(skb, HWSIM_TM_ATTR_PS, hwsim->ps);
 +              if (nla_put_u32(skb, HWSIM_TM_ATTR_PS, hwsim->ps))
 +                      goto nla_put_failure;
                return cfg80211_testmode_reply(skb);
        default:
                return -EOPNOTSUPP;
index b41428f5b3b254ff32125bac149130f252731a69,9cda706e4e3f83bf107e1889b2a12873aa4000ac..0e59ea2cdd39ea59376347ec03103167f4bf7349
  #include <linux/slab.h>
  #include <net/genetlink.h>
  
- #include "wl12xx.h"
+ #include "wlcore.h"
  #include "debug.h"
  #include "acx.h"
- #include "reg.h"
  #include "ps.h"
  #include "io.h"
  
@@@ -116,8 -115,7 +115,8 @@@ static int wl1271_tm_cmd_test(struct wl
                        goto out_sleep;
                }
  
 -              NLA_PUT(skb, WL1271_TM_ATTR_DATA, buf_len, buf);
 +              if (nla_put(skb, WL1271_TM_ATTR_DATA, buf_len, buf))
 +                      goto nla_put_failure;
                ret = cfg80211_testmode_reply(skb);
                if (ret < 0)
                        goto out_sleep;
@@@ -179,8 -177,7 +178,8 @@@ static int wl1271_tm_cmd_interrogate(st
                goto out_free;
        }
  
 -      NLA_PUT(skb, WL1271_TM_ATTR_DATA, sizeof(*cmd), cmd);
 +      if (nla_put(skb, WL1271_TM_ATTR_DATA, sizeof(*cmd), cmd))
 +              goto nla_put_failure;
        ret = cfg80211_testmode_reply(skb);
        if (ret < 0)
                goto out_free;
@@@ -299,8 -296,7 +298,8 @@@ static int wl12xx_tm_cmd_get_mac(struc
                goto out;
        }
  
 -      NLA_PUT(skb, WL1271_TM_ATTR_DATA, ETH_ALEN, mac_addr);
 +      if (nla_put(skb, WL1271_TM_ATTR_DATA, ETH_ALEN, mac_addr))
 +              goto nla_put_failure;
        ret = cfg80211_testmode_reply(skb);
        if (ret < 0)
                goto out;
diff --combined include/net/nfc/nfc.h
index 79955a238ccc14f87ae6ce56e873e3e6b86fa1a5,313d00fac2762dbc9ca9815760d26c9842dd3da6..9a2505a5b8de7687aa266f6f631b0b4a7396021e
@@@ -62,10 -62,12 +62,12 @@@ struct nfc_ops 
        int (*data_exchange)(struct nfc_dev *dev, u32 target_idx,
                             struct sk_buff *skb, data_exchange_cb_t cb,
                             void *cb_context);
+       int (*check_presence)(struct nfc_dev *dev, u32 target_idx);
  };
  
  #define NFC_TARGET_IDX_ANY -1
  #define NFC_MAX_GT_LEN 48
+ #define NFC_TARGET_IDX_NONE 0xffffffff
  
  struct nfc_target {
        u32 idx;
@@@ -78,6 -80,8 +80,8 @@@
        u8 sensb_res[NFC_SENSB_RES_MAXSIZE];
        u8 sensf_res_len;
        u8 sensf_res[NFC_SENSF_RES_MAXSIZE];
+       u8 hci_reader_gate;
+       u8 logical_idx;
  };
  
  struct nfc_genl_data {
@@@ -86,7 -90,8 +90,8 @@@
  };
  
  struct nfc_dev {
 -      unsigned idx;
 +      unsigned int idx;
+       u32 target_next_idx;
        struct nfc_target *targets;
        int n_targets;
        int targets_generation;
@@@ -94,7 -99,7 +99,7 @@@
        struct device dev;
        bool dev_up;
        bool polling;
-       bool remote_activated;
+       u32 activated_target_idx;
        bool dep_link_up;
        u32 dep_rf_mode;
        struct nfc_genl_data genl_data;
        int tx_headroom;
        int tx_tailroom;
  
+       struct timer_list check_pres_timer;
+       struct workqueue_struct *check_pres_wq;
+       struct work_struct check_pres_work;
        struct nfc_ops *ops;
  };
  #define to_nfc_dev(_dev) container_of(_dev, struct nfc_dev, dev)
@@@ -181,6 -190,7 +190,7 @@@ int nfc_set_remote_general_bytes(struc
  
  int nfc_targets_found(struct nfc_dev *dev,
                      struct nfc_target *targets, int ntargets);
+ int nfc_target_lost(struct nfc_dev *dev, u32 target_idx);
  
  int nfc_dep_link_is_up(struct nfc_dev *dev, u32 target_idx,
                       u8 comm_mode, u8 rf_mode);
diff --combined net/nfc/core.c
index 32a7b615e65fdbce82a7a3027f065e6b84084198,da353275fbc62be4dbccc5960bb3ea5410ebbdbf..3192c3f589eea87eb5f6e04f4803b584c36101fb
@@@ -33,6 -33,8 +33,8 @@@
  
  #define VERSION "0.1"
  
+ #define NFC_CHECK_PRES_FREQ_MS        2000
  int nfc_devlist_generation;
  DEFINE_MUTEX(nfc_devlist_mutex);
  
@@@ -95,7 -97,7 +97,7 @@@ int nfc_dev_down(struct nfc_dev *dev
                goto error;
        }
  
-       if (dev->polling || dev->remote_activated) {
+       if (dev->polling || dev->activated_target_idx != NFC_TARGET_IDX_NONE) {
                rc = -EBUSY;
                goto error;
        }
@@@ -211,6 -213,8 +213,8 @@@ int nfc_dep_link_up(struct nfc_dev *dev
        }
  
        rc = dev->ops->dep_link_up(dev, target_index, comm_mode, gb, gb_len);
+       if (!rc)
+               dev->activated_target_idx = target_index;
  
  error:
        device_unlock(&dev->dev);
@@@ -246,6 -250,7 +250,7 @@@ int nfc_dep_link_down(struct nfc_dev *d
        rc = dev->ops->dep_link_down(dev);
        if (!rc) {
                dev->dep_link_up = false;
+               dev->activated_target_idx = NFC_TARGET_IDX_NONE;
                nfc_llcp_mac_is_down(dev);
                nfc_genl_dep_link_down_event(dev);
        }
@@@ -289,8 -294,13 +294,13 @@@ int nfc_activate_target(struct nfc_dev 
        }
  
        rc = dev->ops->activate_target(dev, target_idx, protocol);
-       if (!rc)
-               dev->remote_activated = true;
+       if (!rc) {
+               dev->activated_target_idx = target_idx;
+               if (dev->ops->check_presence)
+                       mod_timer(&dev->check_pres_timer, jiffies +
+                                 msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
+       }
  
  error:
        device_unlock(&dev->dev);
@@@ -317,8 -327,11 +327,11 @@@ int nfc_deactivate_target(struct nfc_de
                goto error;
        }
  
+       if (dev->ops->check_presence)
+               del_timer_sync(&dev->check_pres_timer);
        dev->ops->deactivate_target(dev, target_idx);
-       dev->remote_activated = false;
+       dev->activated_target_idx = NFC_TARGET_IDX_NONE;
  
  error:
        device_unlock(&dev->dev);
@@@ -352,8 -365,27 +365,27 @@@ int nfc_data_exchange(struct nfc_dev *d
                goto error;
        }
  
+       if (dev->activated_target_idx == NFC_TARGET_IDX_NONE) {
+               rc = -ENOTCONN;
+               kfree_skb(skb);
+               goto error;
+       }
+       if (target_idx != dev->activated_target_idx) {
+               rc = -EADDRNOTAVAIL;
+               kfree_skb(skb);
+               goto error;
+       }
+       if (dev->ops->check_presence)
+               del_timer_sync(&dev->check_pres_timer);
        rc = dev->ops->data_exchange(dev, target_idx, skb, cb, cb_context);
  
+       if (!rc && dev->ops->check_presence)
+               mod_timer(&dev->check_pres_timer, jiffies +
+                         msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
  error:
        device_unlock(&dev->dev);
        return rc;
@@@ -428,10 -460,15 +460,15 @@@ EXPORT_SYMBOL(nfc_alloc_recv_skb)
  int nfc_targets_found(struct nfc_dev *dev,
                      struct nfc_target *targets, int n_targets)
  {
+       int i;
        pr_debug("dev_name=%s n_targets=%d\n", dev_name(&dev->dev), n_targets);
  
        dev->polling = false;
  
+       for (i = 0; i < n_targets; i++)
+               targets[i].idx = dev->target_next_idx++;
        spin_lock_bh(&dev->targets_lock);
  
        dev->targets_generation++;
  }
  EXPORT_SYMBOL(nfc_targets_found);
  
+ int nfc_target_lost(struct nfc_dev *dev, u32 target_idx)
+ {
+       struct nfc_target *tg;
+       int i;
+       pr_debug("dev_name %s n_target %d\n", dev_name(&dev->dev), target_idx);
+       spin_lock_bh(&dev->targets_lock);
+       for (i = 0; i < dev->n_targets; i++) {
+               tg = &dev->targets[i];
+               if (tg->idx == target_idx)
+                       break;
+       }
+       if (i == dev->n_targets) {
+               spin_unlock_bh(&dev->targets_lock);
+               return -EINVAL;
+       }
+       dev->targets_generation++;
+       dev->n_targets--;
+       dev->activated_target_idx = NFC_TARGET_IDX_NONE;
+       if (dev->n_targets) {
+               memcpy(&dev->targets[i], &dev->targets[i + 1],
+                      (dev->n_targets - i) * sizeof(struct nfc_target));
+       } else {
+               kfree(dev->targets);
+               dev->targets = NULL;
+       }
+       spin_unlock_bh(&dev->targets_lock);
+       nfc_genl_target_lost(dev, target_idx);
+       return 0;
+ }
+ EXPORT_SYMBOL(nfc_target_lost);
  static void nfc_release(struct device *d)
  {
        struct nfc_dev *dev = to_nfc_dev(d);
  
        pr_debug("dev_name=%s\n", dev_name(&dev->dev));
  
+       if (dev->ops->check_presence) {
+               del_timer_sync(&dev->check_pres_timer);
+               destroy_workqueue(dev->check_pres_wq);
+       }
        nfc_genl_data_exit(&dev->genl_data);
        kfree(dev->targets);
        kfree(dev);
  }
  
+ static void nfc_check_pres_work(struct work_struct *work)
+ {
+       struct nfc_dev *dev = container_of(work, struct nfc_dev,
+                                          check_pres_work);
+       int rc;
+       device_lock(&dev->dev);
+       if (dev->activated_target_idx != NFC_TARGET_IDX_NONE &&
+           timer_pending(&dev->check_pres_timer) == 0) {
+               rc = dev->ops->check_presence(dev, dev->activated_target_idx);
+               if (!rc) {
+                       mod_timer(&dev->check_pres_timer, jiffies +
+                                 msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
+               } else {
+                       nfc_target_lost(dev, dev->activated_target_idx);
+                       dev->activated_target_idx = NFC_TARGET_IDX_NONE;
+               }
+       }
+       device_unlock(&dev->dev);
+ }
+ static void nfc_check_pres_timeout(unsigned long data)
+ {
+       struct nfc_dev *dev = (struct nfc_dev *)data;
+       queue_work(dev->check_pres_wq, &dev->check_pres_work);
+ }
  struct class nfc_class = {
        .name = "nfc",
        .dev_release = nfc_release,
@@@ -475,12 -587,12 +587,12 @@@ EXPORT_SYMBOL(nfc_class)
  static int match_idx(struct device *d, void *data)
  {
        struct nfc_dev *dev = to_nfc_dev(d);
 -      unsigned *idx = data;
 +      unsigned int *idx = data;
  
        return dev->idx == *idx;
  }
  
 -struct nfc_dev *nfc_get_device(unsigned idx)
 +struct nfc_dev *nfc_get_device(unsigned int idx)
  {
        struct device *d;
  
@@@ -531,6 -643,26 +643,26 @@@ struct nfc_dev *nfc_allocate_device(str
        /* first generation must not be 0 */
        dev->targets_generation = 1;
  
+       dev->activated_target_idx = NFC_TARGET_IDX_NONE;
+       if (ops->check_presence) {
+               char name[32];
+               init_timer(&dev->check_pres_timer);
+               dev->check_pres_timer.data = (unsigned long)dev;
+               dev->check_pres_timer.function = nfc_check_pres_timeout;
+               INIT_WORK(&dev->check_pres_work, nfc_check_pres_work);
+               snprintf(name, sizeof(name), "nfc%d_check_pres_wq", dev->idx);
+               dev->check_pres_wq = alloc_workqueue(name, WQ_NON_REENTRANT |
+                                                    WQ_UNBOUND |
+                                                    WQ_MEM_RECLAIM, 1);
+               if (dev->check_pres_wq == NULL) {
+                       kfree(dev);
+                       return NULL;
+               }
+       }
        return dev;
  }
  EXPORT_SYMBOL(nfc_allocate_device);
diff --combined net/nfc/netlink.c
index 8937664674fae623f4ec8e27fad62e5d2e8c9ec4,ebdb605f8dbd16f40e8028309340d46d18e75bee..f1829f6ae9c552fab7b2090fddb2283511b7f4d5
@@@ -63,23 -63,19 +63,23 @@@ static int nfc_genl_send_target(struct 
  
        genl_dump_check_consistent(cb, hdr, &nfc_genl_family);
  
 -      NLA_PUT_U32(msg, NFC_ATTR_TARGET_INDEX, target->idx);
 -      NLA_PUT_U32(msg, NFC_ATTR_PROTOCOLS, target->supported_protocols);
 -      NLA_PUT_U16(msg, NFC_ATTR_TARGET_SENS_RES, target->sens_res);
 -      NLA_PUT_U8(msg, NFC_ATTR_TARGET_SEL_RES, target->sel_res);
 -      if (target->nfcid1_len > 0)
 -              NLA_PUT(msg, NFC_ATTR_TARGET_NFCID1, target->nfcid1_len,
 -                      target->nfcid1);
 -      if (target->sensb_res_len > 0)
 -              NLA_PUT(msg, NFC_ATTR_TARGET_SENSB_RES, target->sensb_res_len,
 -                      target->sensb_res);
 -      if (target->sensf_res_len > 0)
 -              NLA_PUT(msg, NFC_ATTR_TARGET_SENSF_RES, target->sensf_res_len,
 -                      target->sensf_res);
 +      if (nla_put_u32(msg, NFC_ATTR_TARGET_INDEX, target->idx) ||
 +          nla_put_u32(msg, NFC_ATTR_PROTOCOLS, target->supported_protocols) ||
 +          nla_put_u16(msg, NFC_ATTR_TARGET_SENS_RES, target->sens_res) ||
 +          nla_put_u8(msg, NFC_ATTR_TARGET_SEL_RES, target->sel_res))
 +              goto nla_put_failure;
 +      if (target->nfcid1_len > 0 &&
 +          nla_put(msg, NFC_ATTR_TARGET_NFCID1, target->nfcid1_len,
 +                  target->nfcid1))
 +              goto nla_put_failure;
 +      if (target->sensb_res_len > 0 &&
 +          nla_put(msg, NFC_ATTR_TARGET_SENSB_RES, target->sensb_res_len,
 +                  target->sensb_res))
 +              goto nla_put_failure;
 +      if (target->sensf_res_len > 0 &&
 +          nla_put(msg, NFC_ATTR_TARGET_SENSF_RES, target->sensf_res_len,
 +                  target->sensf_res))
 +              goto nla_put_failure;
  
        return genlmsg_end(msg, hdr);
  
@@@ -174,8 -170,7 +174,8 @@@ int nfc_genl_targets_found(struct nfc_d
        if (!hdr)
                goto free_msg;
  
 -      NLA_PUT_U32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx);
 +      if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -188,6 -183,36 +188,37 @@@ free_msg
        return -EMSGSIZE;
  }
  
 -      NLA_PUT_STRING(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev));
 -      NLA_PUT_U32(msg, NFC_ATTR_TARGET_INDEX, target_idx);
+ int nfc_genl_target_lost(struct nfc_dev *dev, u32 target_idx)
+ {
+       struct sk_buff *msg;
+       void *hdr;
+       msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+       if (!msg)
+               return -ENOMEM;
+       hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
+                         NFC_EVENT_TARGET_LOST);
+       if (!hdr)
+               goto free_msg;
++      if (nla_put_string(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev)) ||
++          nla_put_u32(msg, NFC_ATTR_TARGET_INDEX, target_idx))
++              goto nla_put_failure;
+       genlmsg_end(msg, hdr);
+       genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+       return 0;
+ nla_put_failure:
+       genlmsg_cancel(msg, hdr);
+ free_msg:
+       nlmsg_free(msg);
+       return -EMSGSIZE;
+ }
  int nfc_genl_device_added(struct nfc_dev *dev)
  {
        struct sk_buff *msg;
        if (!hdr)
                goto free_msg;
  
 -      NLA_PUT_STRING(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev));
 -      NLA_PUT_U32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx);
 -      NLA_PUT_U32(msg, NFC_ATTR_PROTOCOLS, dev->supported_protocols);
 -      NLA_PUT_U8(msg, NFC_ATTR_DEVICE_POWERED, dev->dev_up);
 +      if (nla_put_string(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev)) ||
 +          nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx) ||
 +          nla_put_u32(msg, NFC_ATTR_PROTOCOLS, dev->supported_protocols) ||
 +          nla_put_u8(msg, NFC_ATTR_DEVICE_POWERED, dev->dev_up))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -235,8 -259,7 +266,8 @@@ int nfc_genl_device_removed(struct nfc_
        if (!hdr)
                goto free_msg;
  
 -      NLA_PUT_U32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx);
 +      if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -266,11 -289,10 +297,11 @@@ static int nfc_genl_send_device(struct 
        if (cb)
                genl_dump_check_consistent(cb, hdr, &nfc_genl_family);
  
 -      NLA_PUT_STRING(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev));
 -      NLA_PUT_U32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx);
 -      NLA_PUT_U32(msg, NFC_ATTR_PROTOCOLS, dev->supported_protocols);
 -      NLA_PUT_U8(msg, NFC_ATTR_DEVICE_POWERED, dev->dev_up);
 +      if (nla_put_string(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev)) ||
 +          nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx) ||
 +          nla_put_u32(msg, NFC_ATTR_PROTOCOLS, dev->supported_protocols) ||
 +          nla_put_u8(msg, NFC_ATTR_DEVICE_POWERED, dev->dev_up))
 +              goto nla_put_failure;
  
        return genlmsg_end(msg, hdr);
  
@@@ -347,14 -369,11 +378,14 @@@ int nfc_genl_dep_link_up_event(struct n
        if (!hdr)
                goto free_msg;
  
 -      NLA_PUT_U32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx);
 -      if (rf_mode == NFC_RF_INITIATOR)
 -              NLA_PUT_U32(msg, NFC_ATTR_TARGET_INDEX, target_idx);
 -      NLA_PUT_U8(msg, NFC_ATTR_COMM_MODE, comm_mode);
 -      NLA_PUT_U8(msg, NFC_ATTR_RF_MODE, rf_mode);
 +      if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
 +              goto nla_put_failure;
 +      if (rf_mode == NFC_RF_INITIATOR &&
 +          nla_put_u32(msg, NFC_ATTR_TARGET_INDEX, target_idx))
 +              goto nla_put_failure;
 +      if (nla_put_u8(msg, NFC_ATTR_COMM_MODE, comm_mode) ||
 +          nla_put_u8(msg, NFC_ATTR_RF_MODE, rf_mode))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -387,8 -406,7 +418,8 @@@ int nfc_genl_dep_link_down_event(struc
        if (!hdr)
                goto free_msg;
  
 -      NLA_PUT_U32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx);
 +      if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
diff --combined net/nfc/nfc.h
index 061a830b0a884004f5ce4b55c7f11b8a25a31a2f,2c868d2b3c57bed9672ca2dff1880befc79001ef..7d589a81942e169cb21792754452a9f6c2ea69a9
@@@ -119,6 -119,7 +119,7 @@@ void nfc_genl_data_init(struct nfc_genl
  void nfc_genl_data_exit(struct nfc_genl_data *genl_data);
  
  int nfc_genl_targets_found(struct nfc_dev *dev);
+ int nfc_genl_target_lost(struct nfc_dev *dev, u32 target_idx);
  
  int nfc_genl_device_added(struct nfc_dev *dev);
  int nfc_genl_device_removed(struct nfc_dev *dev);
@@@ -127,7 -128,7 +128,7 @@@ int nfc_genl_dep_link_up_event(struct n
                               u8 comm_mode, u8 rf_mode);
  int nfc_genl_dep_link_down_event(struct nfc_dev *dev);
  
 -struct nfc_dev *nfc_get_device(unsigned idx);
 +struct nfc_dev *nfc_get_device(unsigned int idx);
  
  static inline void nfc_put_device(struct nfc_dev *dev)
  {
diff --combined net/wireless/nl80211.c
index ff1a6c7fbe3392d17860d866399606449b9270d4,bcf6f70e518db6654349fcaf852fb33720c76179..83d71d6b63a45570dbdceea6a4fdb82c70c93d21
@@@ -356,26 -356,20 +356,26 @@@ static inline void *nl80211hdr_put(stru
  static int nl80211_msg_put_channel(struct sk_buff *msg,
                                   struct ieee80211_channel *chan)
  {
 -      NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 -                  chan->center_freq);
 +      if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 +                      chan->center_freq))
 +              goto nla_put_failure;
  
 -      if (chan->flags & IEEE80211_CHAN_DISABLED)
 -              NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 -      if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 -              NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 -      if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 -              NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 -      if (chan->flags & IEEE80211_CHAN_RADAR)
 -              NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 +      if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 +          nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 +              goto nla_put_failure;
 +      if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 +          nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 +              goto nla_put_failure;
 +      if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 +          nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 +              goto nla_put_failure;
 +      if ((chan->flags & IEEE80211_CHAN_RADAR) &&
 +          nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 +              goto nla_put_failure;
  
 -      NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 -                  DBM_TO_MBM(chan->max_power));
 +      if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 +                      DBM_TO_MBM(chan->max_power)))
 +              goto nla_put_failure;
  
        return 0;
  
@@@ -627,8 -621,8 +627,8 @@@ static int nl80211_put_iftypes(struct s
  
        i = 0;
        while (ifmodes) {
 -              if (ifmodes & 1)
 -                      NLA_PUT_FLAG(msg, i);
 +              if ((ifmodes & 1) && nla_put_flag(msg, i))
 +                      goto nla_put_failure;
                ifmodes >>= 1;
                i++;
        }
@@@ -671,9 -665,8 +671,9 @@@ static int nl80211_put_iface_combinatio
                        nl_limit = nla_nest_start(msg, j + 1);
                        if (!nl_limit)
                                goto nla_put_failure;
 -                      NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
 -                                  c->limits[j].max);
 +                      if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 +                                      c->limits[j].max))
 +                              goto nla_put_failure;
                        if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
                                                c->limits[j].types))
                                goto nla_put_failure;
  
                nla_nest_end(msg, nl_limits);
  
 -              if (c->beacon_int_infra_match)
 -                      NLA_PUT_FLAG(msg,
 -                              NL80211_IFACE_COMB_STA_AP_BI_MATCH);
 -              NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 -                          c->num_different_channels);
 -              NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
 -                          c->max_interfaces);
 +              if (c->beacon_int_infra_match &&
 +                  nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 +                      goto nla_put_failure;
 +              if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 +                              c->num_different_channels) ||
 +                  nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 +                              c->max_interfaces))
 +                      goto nla_put_failure;
  
                nla_nest_end(msg, nl_combi);
        }
@@@ -720,74 -712,64 +720,74 @@@ static int nl80211_send_wiphy(struct sk
        if (!hdr)
                return -1;
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 -      NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 -
 -      NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 -                  cfg80211_rdev_list_generation);
 -
 -      NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 -                 dev->wiphy.retry_short);
 -      NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 -                 dev->wiphy.retry_long);
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 -                  dev->wiphy.frag_threshold);
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 -                  dev->wiphy.rts_threshold);
 -      NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 -                  dev->wiphy.coverage_class);
 -      NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 -                 dev->wiphy.max_scan_ssids);
 -      NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 -                 dev->wiphy.max_sched_scan_ssids);
 -      NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 -                  dev->wiphy.max_scan_ie_len);
 -      NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 -                  dev->wiphy.max_sched_scan_ie_len);
 -      NLA_PUT_U8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 -                 dev->wiphy.max_match_sets);
 -
 -      if (dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)
 -              NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_IBSS_RSN);
 -      if (dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH)
 -              NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_MESH_AUTH);
 -      if (dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD)
 -              NLA_PUT_FLAG(msg, NL80211_ATTR_SUPPORT_AP_UAPSD);
 -      if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)
 -              NLA_PUT_FLAG(msg, NL80211_ATTR_ROAM_SUPPORT);
 -      if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)
 -              NLA_PUT_FLAG(msg, NL80211_ATTR_TDLS_SUPPORT);
 -      if (dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)
 -              NLA_PUT_FLAG(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP);
 -
 -      NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 -              sizeof(u32) * dev->wiphy.n_cipher_suites,
 -              dev->wiphy.cipher_suites);
 -
 -      NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 -                 dev->wiphy.max_num_pmkids);
 -
 -      if (dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL)
 -              NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE);
 -
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 -                  dev->wiphy.available_antennas_tx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 -                  dev->wiphy.available_antennas_rx);
 -
 -      if (dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD)
 -              NLA_PUT_U32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
 -                          dev->wiphy.probe_resp_offload);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
 +          nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
 +          nla_put_u32(msg, NL80211_ATTR_GENERATION,
 +                      cfg80211_rdev_list_generation) ||
 +          nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 +                     dev->wiphy.retry_short) ||
 +          nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 +                     dev->wiphy.retry_long) ||
 +          nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 +                      dev->wiphy.frag_threshold) ||
 +          nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 +                      dev->wiphy.rts_threshold) ||
 +          nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 +                     dev->wiphy.coverage_class) ||
 +          nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 +                     dev->wiphy.max_scan_ssids) ||
 +          nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 +                     dev->wiphy.max_sched_scan_ssids) ||
 +          nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 +                      dev->wiphy.max_scan_ie_len) ||
 +          nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 +                      dev->wiphy.max_sched_scan_ie_len) ||
 +          nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 +                     dev->wiphy.max_match_sets))
 +              goto nla_put_failure;
 +
 +      if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
 +          nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
 +              goto nla_put_failure;
 +      if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
 +          nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
 +              goto nla_put_failure;
 +      if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
 +          nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
 +              goto nla_put_failure;
 +      if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
 +          nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
 +              goto nla_put_failure;
 +      if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
 +          nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
 +              goto nla_put_failure;
 +      if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
 +          nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
 +              goto nla_put_failure;
 +
 +      if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
 +                  sizeof(u32) * dev->wiphy.n_cipher_suites,
 +                  dev->wiphy.cipher_suites))
 +              goto nla_put_failure;
 +
 +      if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 +                     dev->wiphy.max_num_pmkids))
 +              goto nla_put_failure;
 +
 +      if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
 +          nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
 +              goto nla_put_failure;
 +
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 +                      dev->wiphy.available_antennas_tx) ||
 +          nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 +                      dev->wiphy.available_antennas_rx))
 +              goto nla_put_failure;
 +
 +      if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
 +          nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
 +                      dev->wiphy.probe_resp_offload))
 +              goto nla_put_failure;
  
        if ((dev->wiphy.available_antennas_tx ||
             dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
                int res;
                res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
                if (!res) {
 -                      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX, tx_ant);
 -                      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX, rx_ant);
 +                      if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
 +                                      tx_ant) ||
 +                          nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
 +                                      rx_ant))
 +                              goto nla_put_failure;
                }
        }
  
                        goto nla_put_failure;
  
                /* add HT info */
 -              if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 -                      NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 -                              sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 -                              &dev->wiphy.bands[band]->ht_cap.mcs);
 -                      NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 -                              dev->wiphy.bands[band]->ht_cap.cap);
 -                      NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 -                              dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 -                      NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 -                              dev->wiphy.bands[band]->ht_cap.ampdu_density);
 -              }
 +              if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
 +                  (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 +                           sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 +                           &dev->wiphy.bands[band]->ht_cap.mcs) ||
 +                   nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
 +                               dev->wiphy.bands[band]->ht_cap.cap) ||
 +                   nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 +                              dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
 +                   nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 +                              dev->wiphy.bands[band]->ht_cap.ampdu_density)))
 +                      goto nla_put_failure;
  
                /* add frequencies */
                nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
                                goto nla_put_failure;
  
                        rate = &dev->wiphy.bands[band]->bitrates[i];
 -                      NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 -                                  rate->bitrate);
 -                      if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 -                              NLA_PUT_FLAG(msg,
 -                                      NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 +                      if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
 +                                      rate->bitrate))
 +                              goto nla_put_failure;
 +                      if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
 +                          nla_put_flag(msg,
 +                                       NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
 +                              goto nla_put_failure;
  
                        nla_nest_end(msg, nl_rate);
                }
         do {                                                   \
                if (dev->ops->op) {                             \
                        i++;                                    \
 -                      NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 +                      if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
 +                              goto nla_put_failure;           \
                }                                               \
        } while (0)
  
        CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
        if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
                i++;
 -              NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 +              if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
 +                      goto nla_put_failure;
        }
        CMD(set_channel, SET_CHANNEL);
        CMD(set_wds_peer, SET_WDS_PEER);
        CMD(set_noack_map, SET_NOACK_MAP);
        if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
                i++;
 -              NLA_PUT_U32(msg, i, NL80211_CMD_REGISTER_BEACONS);
 +              if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
 +                      goto nla_put_failure;
        }
  
  #ifdef CONFIG_NL80211_TESTMODE
  
        if (dev->ops->connect || dev->ops->auth) {
                i++;
 -              NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 +              if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
 +                      goto nla_put_failure;
        }
  
        if (dev->ops->disconnect || dev->ops->deauth) {
                i++;
 -              NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 +              if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
 +                      goto nla_put_failure;
        }
  
        nla_nest_end(msg, nl_cmds);
  
        if (dev->ops->remain_on_channel &&
 -          dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
 -              NLA_PUT_U32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
 -                          dev->wiphy.max_remain_on_channel_duration);
 +          (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
 +          nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
 +                      dev->wiphy.max_remain_on_channel_duration))
 +              goto nla_put_failure;
  
 -      if (dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)
 -              NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
 +      if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
 +          nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
 +              goto nla_put_failure;
  
        if (mgmt_stypes) {
                u16 stypes;
                        i = 0;
                        stypes = mgmt_stypes[ift].tx;
                        while (stypes) {
 -                              if (stypes & 1)
 -                                      NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 -                                                  (i << 4) | IEEE80211_FTYPE_MGMT);
 +                              if ((stypes & 1) &&
 +                                  nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
 +                                              (i << 4) | IEEE80211_FTYPE_MGMT))
 +                                      goto nla_put_failure;
                                stypes >>= 1;
                                i++;
                        }
                        i = 0;
                        stypes = mgmt_stypes[ift].rx;
                        while (stypes) {
 -                              if (stypes & 1)
 -                                      NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE,
 -                                                  (i << 4) | IEEE80211_FTYPE_MGMT);
 +                              if ((stypes & 1) &&
 +                                  nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
 +                                              (i << 4) | IEEE80211_FTYPE_MGMT))
 +                                      goto nla_put_failure;
                                stypes >>= 1;
                                i++;
                        }
                if (!nl_wowlan)
                        goto nla_put_failure;
  
 -              if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
 -              if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
 -              if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
 -              if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED);
 -              if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
 -              if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
 -              if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
 -              if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
 +              if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
 +                  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
 +                  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
 +                  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
 +                  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
 +                  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
 +                  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
 +                  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
 +                  goto nla_put_failure;
                if (dev->wiphy.wowlan.n_patterns) {
                        struct nl80211_wowlan_pattern_support pat = {
                                .max_patterns = dev->wiphy.wowlan.n_patterns,
                                .max_pattern_len =
                                        dev->wiphy.wowlan.pattern_max_len,
                        };
 -                      NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 -                              sizeof(pat), &pat);
 +                      if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 +                                  sizeof(pat), &pat))
 +                              goto nla_put_failure;
                }
  
                nla_nest_end(msg, nl_wowlan);
        if (nl80211_put_iface_combinations(&dev->wiphy, msg))
                goto nla_put_failure;
  
 -      if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME)
 -              NLA_PUT_U32(msg, NL80211_ATTR_DEVICE_AP_SME,
 -                          dev->wiphy.ap_sme_capa);
 +      if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
 +          nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
 +                      dev->wiphy.ap_sme_capa))
 +              goto nla_put_failure;
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_FEATURE_FLAGS, dev->wiphy.features);
 +      if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
 +                      dev->wiphy.features))
 +              goto nla_put_failure;
  
 -      if (dev->wiphy.ht_capa_mod_mask)
 -              NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
 -                      sizeof(*dev->wiphy.ht_capa_mod_mask),
 -                      dev->wiphy.ht_capa_mod_mask);
 +      if (dev->wiphy.ht_capa_mod_mask &&
 +          nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
 +                  sizeof(*dev->wiphy.ht_capa_mod_mask),
 +                  dev->wiphy.ht_capa_mod_mask))
 +              goto nla_put_failure;
  
        return genlmsg_end(msg, hdr);
  
@@@ -1530,16 -1492,28 +1530,29 @@@ static int nl80211_send_iface(struct sk
        if (!hdr)
                return -1;
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 -
 -      NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 -                  rdev->devlist_generation ^
 -                      (cfg80211_rdev_list_generation << 2));
 +      if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 +          nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFTYPE,
 +                      dev->ieee80211_ptr->iftype) ||
 +          nla_put_u32(msg, NL80211_ATTR_GENERATION,
 +                      rdev->devlist_generation ^
 +                      (cfg80211_rdev_list_generation << 2)))
 +              goto nla_put_failure;
  
 -              if (chan) {
 -                      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ,
 -                                  chan->center_freq);
 -                      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
 -                                  channel_type);
 -              }
+       if (rdev->ops->get_channel) {
+               struct ieee80211_channel *chan;
+               enum nl80211_channel_type channel_type;
+               chan = rdev->ops->get_channel(&rdev->wiphy, &channel_type);
++              if (chan &&
++                  (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
++                                  chan->center_freq) ||
++                   nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
++                                  channel_type)))
++                      goto nla_put_failure;
+       }
        return genlmsg_end(msg, hdr);
  
   nla_put_failure:
@@@ -1836,34 -1810,35 +1849,34 @@@ static void get_key_callback(void *c, s
        struct nlattr *key;
        struct get_key_cookie *cookie = c;
  
 -      if (params->key)
 -              NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 -                      params->key_len, params->key);
 -
 -      if (params->seq)
 -              NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 -                      params->seq_len, params->seq);
 -
 -      if (params->cipher)
 -              NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 -                          params->cipher);
 +      if ((params->key &&
 +           nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
 +                   params->key_len, params->key)) ||
 +          (params->seq &&
 +           nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
 +                   params->seq_len, params->seq)) ||
 +          (params->cipher &&
 +           nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 +                       params->cipher)))
 +              goto nla_put_failure;
  
        key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
        if (!key)
                goto nla_put_failure;
  
 -      if (params->key)
 -              NLA_PUT(cookie->msg, NL80211_KEY_DATA,
 -                      params->key_len, params->key);
 -
 -      if (params->seq)
 -              NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
 -                      params->seq_len, params->seq);
 -
 -      if (params->cipher)
 -              NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
 -                          params->cipher);
 +      if ((params->key &&
 +           nla_put(cookie->msg, NL80211_KEY_DATA,
 +                   params->key_len, params->key)) ||
 +          (params->seq &&
 +           nla_put(cookie->msg, NL80211_KEY_SEQ,
 +                   params->seq_len, params->seq)) ||
 +          (params->cipher &&
 +           nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
 +                       params->cipher)))
 +              goto nla_put_failure;
  
 -      NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
 +      if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
 +              goto nla_put_failure;
  
        nla_nest_end(cookie->msg, key);
  
@@@ -1921,12 -1896,10 +1934,12 @@@ static int nl80211_get_key(struct sk_bu
        cookie.msg = msg;
        cookie.idx = key_idx;
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 -      NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
 -      if (mac_addr)
 -              NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 +      if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 +          nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
 +              goto nla_put_failure;
 +      if (mac_addr &&
 +          nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
 +              goto nla_put_failure;
  
        if (pairwise && mac_addr &&
            !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
@@@ -2416,15 -2389,15 +2429,15 @@@ static bool nl80211_put_sta_rate(struc
  
        /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
        bitrate = cfg80211_calculate_bitrate(info);
 -      if (bitrate > 0)
 -              NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
 -
 -      if (info->flags & RATE_INFO_FLAGS_MCS)
 -              NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS, info->mcs);
 -      if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
 -              NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
 -      if (info->flags & RATE_INFO_FLAGS_SHORT_GI)
 -              NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
 +      if ((bitrate > 0 &&
 +           nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate)) ||
 +          ((info->flags & RATE_INFO_FLAGS_MCS) &&
 +           nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) ||
 +          ((info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) &&
 +           nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH)) ||
 +          ((info->flags & RATE_INFO_FLAGS_SHORT_GI) &&
 +           nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)))
 +              goto nla_put_failure;
  
        nla_nest_end(msg, rate);
        return true;
@@@ -2446,50 -2419,43 +2459,50 @@@ static int nl80211_send_station(struct 
        if (!hdr)
                return -1;
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 -      NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 -
 -      NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
 +      if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 +          nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
 +          nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
 +              goto nla_put_failure;
  
        sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
        if (!sinfoattr)
                goto nla_put_failure;
 -      if (sinfo->filled & STATION_INFO_CONNECTED_TIME)
 -              NLA_PUT_U32(msg, NL80211_STA_INFO_CONNECTED_TIME,
 -                          sinfo->connected_time);
 -      if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
 -              NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
 -                          sinfo->inactive_time);
 -      if (sinfo->filled & STATION_INFO_RX_BYTES)
 -              NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
 -                          sinfo->rx_bytes);
 -      if (sinfo->filled & STATION_INFO_TX_BYTES)
 -              NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
 -                          sinfo->tx_bytes);
 -      if (sinfo->filled & STATION_INFO_LLID)
 -              NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
 -                          sinfo->llid);
 -      if (sinfo->filled & STATION_INFO_PLID)
 -              NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
 -                          sinfo->plid);
 -      if (sinfo->filled & STATION_INFO_PLINK_STATE)
 -              NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
 -                          sinfo->plink_state);
 +      if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
 +          nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
 +                      sinfo->connected_time))
 +              goto nla_put_failure;
 +      if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
 +          nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
 +                      sinfo->inactive_time))
 +              goto nla_put_failure;
 +      if ((sinfo->filled & STATION_INFO_RX_BYTES) &&
 +          nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
 +                      sinfo->rx_bytes))
 +              goto nla_put_failure;
 +      if ((sinfo->filled & STATION_INFO_TX_BYTES) &&
 +          nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
 +                      sinfo->tx_bytes))
 +              goto nla_put_failure;
 +      if ((sinfo->filled & STATION_INFO_LLID) &&
 +          nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
 +              goto nla_put_failure;
 +      if ((sinfo->filled & STATION_INFO_PLID) &&
 +          nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
 +              goto nla_put_failure;
 +      if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
 +          nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
 +                     sinfo->plink_state))
 +              goto nla_put_failure;
        switch (rdev->wiphy.signal_type) {
        case CFG80211_SIGNAL_TYPE_MBM:
 -              if (sinfo->filled & STATION_INFO_SIGNAL)
 -                      NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
 -                                 sinfo->signal);
 -              if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
 -                      NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
 -                                 sinfo->signal_avg);
 +              if ((sinfo->filled & STATION_INFO_SIGNAL) &&
 +                  nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
 +                             sinfo->signal))
 +                      goto nla_put_failure;
 +              if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
 +                  nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
 +                             sinfo->signal_avg))
 +                      goto nla_put_failure;
                break;
        default:
                break;
                                          NL80211_STA_INFO_RX_BITRATE))
                        goto nla_put_failure;
        }
 -      if (sinfo->filled & STATION_INFO_RX_PACKETS)
 -              NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
 -                          sinfo->rx_packets);
 -      if (sinfo->filled & STATION_INFO_TX_PACKETS)
 -              NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
 -                          sinfo->tx_packets);
 -      if (sinfo->filled & STATION_INFO_TX_RETRIES)
 -              NLA_PUT_U32(msg, NL80211_STA_INFO_TX_RETRIES,
 -                          sinfo->tx_retries);
 -      if (sinfo->filled & STATION_INFO_TX_FAILED)
 -              NLA_PUT_U32(msg, NL80211_STA_INFO_TX_FAILED,
 -                          sinfo->tx_failed);
 -      if (sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT)
 -              NLA_PUT_U32(msg, NL80211_STA_INFO_BEACON_LOSS,
 -                          sinfo->beacon_loss_count);
 +      if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
 +          nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
 +                      sinfo->rx_packets))
 +              goto nla_put_failure;
 +      if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
 +          nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
 +                      sinfo->tx_packets))
 +              goto nla_put_failure;
 +      if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
 +          nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
 +                      sinfo->tx_retries))
 +              goto nla_put_failure;
 +      if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
 +          nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
 +                      sinfo->tx_failed))
 +              goto nla_put_failure;
 +      if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
 +          nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
 +                      sinfo->beacon_loss_count))
 +              goto nla_put_failure;
        if (sinfo->filled & STATION_INFO_BSS_PARAM) {
                bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
                if (!bss_param)
                        goto nla_put_failure;
  
 -              if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT)
 -                      NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_CTS_PROT);
 -              if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE)
 -                      NLA_PUT_FLAG(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE);
 -              if (sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME)
 -                      NLA_PUT_FLAG(msg,
 -                                   NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME);
 -              NLA_PUT_U8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
 -                         sinfo->bss_param.dtim_period);
 -              NLA_PUT_U16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
 -                          sinfo->bss_param.beacon_interval);
 +              if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
 +                   nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
 +                  ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
 +                   nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
 +                  ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
 +                   nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
 +                  nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
 +                             sinfo->bss_param.dtim_period) ||
 +                  nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
 +                              sinfo->bss_param.beacon_interval))
 +                      goto nla_put_failure;
  
                nla_nest_end(msg, bss_param);
        }
 -      if (sinfo->filled & STATION_INFO_STA_FLAGS)
 -              NLA_PUT(msg, NL80211_STA_INFO_STA_FLAGS,
 -                      sizeof(struct nl80211_sta_flag_update),
 -                      &sinfo->sta_flags);
 -      if (sinfo->filled & STATION_INFO_T_OFFSET)
 -              NLA_PUT_U64(msg, NL80211_STA_INFO_T_OFFSET,
 -                          sinfo->t_offset);
 +      if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
 +          nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
 +                  sizeof(struct nl80211_sta_flag_update),
 +                  &sinfo->sta_flags))
 +              goto nla_put_failure;
 +      if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
 +              nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
 +                          sinfo->t_offset))
 +              goto nla_put_failure;
        nla_nest_end(msg, sinfoattr);
  
 -      if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
 -              NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
 -                      sinfo->assoc_req_ies);
 +      if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
 +          nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
 +                  sinfo->assoc_req_ies))
 +              goto nla_put_failure;
  
        return genlmsg_end(msg, hdr);
  
@@@ -2979,37 -2937,36 +2992,37 @@@ static int nl80211_send_mpath(struct sk
        if (!hdr)
                return -1;
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 -      NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
 -      NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
 -
 -      NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
 +      if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 +          nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
 +          nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
 +          nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
 +              goto nla_put_failure;
  
        pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
        if (!pinfoattr)
                goto nla_put_failure;
 -      if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
 -              NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
 -                          pinfo->frame_qlen);
 -      if (pinfo->filled & MPATH_INFO_SN)
 -              NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
 -                          pinfo->sn);
 -      if (pinfo->filled & MPATH_INFO_METRIC)
 -              NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
 -                          pinfo->metric);
 -      if (pinfo->filled & MPATH_INFO_EXPTIME)
 -              NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
 -                          pinfo->exptime);
 -      if (pinfo->filled & MPATH_INFO_FLAGS)
 -              NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
 -                          pinfo->flags);
 -      if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
 -              NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
 -                          pinfo->discovery_timeout);
 -      if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
 -              NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
 -                          pinfo->discovery_retries);
 +      if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
 +          nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
 +                      pinfo->frame_qlen))
 +              goto nla_put_failure;
 +      if (((pinfo->filled & MPATH_INFO_SN) &&
 +           nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
 +          ((pinfo->filled & MPATH_INFO_METRIC) &&
 +           nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
 +                       pinfo->metric)) ||
 +          ((pinfo->filled & MPATH_INFO_EXPTIME) &&
 +           nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
 +                       pinfo->exptime)) ||
 +          ((pinfo->filled & MPATH_INFO_FLAGS) &&
 +           nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
 +                      pinfo->flags)) ||
 +          ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
 +           nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
 +                       pinfo->discovery_timeout)) ||
 +          ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
 +           nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
 +                      pinfo->discovery_retries)))
 +              goto nla_put_failure;
  
        nla_nest_end(msg, pinfoattr);
  
@@@ -3335,50 -3292,49 +3348,50 @@@ static int nl80211_get_mesh_config(stru
        pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
        if (!pinfoattr)
                goto nla_put_failure;
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 -      NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
 -                      cur_params.dot11MeshRetryTimeout);
 -      NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
 -                      cur_params.dot11MeshConfirmTimeout);
 -      NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
 -                      cur_params.dot11MeshHoldingTimeout);
 -      NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
 -                      cur_params.dot11MeshMaxPeerLinks);
 -      NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
 -                      cur_params.dot11MeshMaxRetries);
 -      NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
 -                      cur_params.dot11MeshTTL);
 -      NLA_PUT_U8(msg, NL80211_MESHCONF_ELEMENT_TTL,
 -                      cur_params.element_ttl);
 -      NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
 -                      cur_params.auto_open_plinks);
 -      NLA_PUT_U32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
 -                      cur_params.dot11MeshNbrOffsetMaxNeighbor);
 -      NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
 -                      cur_params.dot11MeshHWMPmaxPREQretries);
 -      NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
 -                      cur_params.path_refresh_time);
 -      NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
 -                      cur_params.min_discovery_timeout);
 -      NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
 -                      cur_params.dot11MeshHWMPactivePathTimeout);
 -      NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
 -                      cur_params.dot11MeshHWMPpreqMinInterval);
 -      NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
 -                      cur_params.dot11MeshHWMPperrMinInterval);
 -      NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
 -                      cur_params.dot11MeshHWMPnetDiameterTraversalTime);
 -      NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
 -                      cur_params.dot11MeshHWMPRootMode);
 -      NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
 -                      cur_params.dot11MeshHWMPRannInterval);
 -      NLA_PUT_U8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
 -                      cur_params.dot11MeshGateAnnouncementProtocol);
 -      NLA_PUT_U8(msg, NL80211_MESHCONF_FORWARDING,
 -                      cur_params.dot11MeshForwarding);
 -      NLA_PUT_U32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
 -                      cur_params.rssi_threshold);
 +      if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 +          nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
 +                      cur_params.dot11MeshRetryTimeout) ||
 +          nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
 +                      cur_params.dot11MeshConfirmTimeout) ||
 +          nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
 +                      cur_params.dot11MeshHoldingTimeout) ||
 +          nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
 +                      cur_params.dot11MeshMaxPeerLinks) ||
 +          nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
 +                     cur_params.dot11MeshMaxRetries) ||
 +          nla_put_u8(msg, NL80211_MESHCONF_TTL,
 +                     cur_params.dot11MeshTTL) ||
 +          nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
 +                     cur_params.element_ttl) ||
 +          nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
 +                     cur_params.auto_open_plinks) ||
 +          nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
 +                      cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
 +          nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
 +                     cur_params.dot11MeshHWMPmaxPREQretries) ||
 +          nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
 +                      cur_params.path_refresh_time) ||
 +          nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
 +                      cur_params.min_discovery_timeout) ||
 +          nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
 +                      cur_params.dot11MeshHWMPactivePathTimeout) ||
 +          nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
 +                      cur_params.dot11MeshHWMPpreqMinInterval) ||
 +          nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
 +                      cur_params.dot11MeshHWMPperrMinInterval) ||
 +          nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
 +                      cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
 +          nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
 +                     cur_params.dot11MeshHWMPRootMode) ||
 +          nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
 +                      cur_params.dot11MeshHWMPRannInterval) ||
 +          nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
 +                     cur_params.dot11MeshGateAnnouncementProtocol) ||
 +          nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
 +                     cur_params.dot11MeshForwarding) ||
 +          nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
 +                      cur_params.rssi_threshold))
 +              goto nla_put_failure;
        nla_nest_end(msg, pinfoattr);
        genlmsg_end(msg, hdr);
        return genlmsg_reply(msg, info);
@@@ -3620,12 -3576,11 +3633,12 @@@ static int nl80211_get_reg(struct sk_bu
        if (!hdr)
                goto put_failure;
  
 -      NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
 -              cfg80211_regdomain->alpha2);
 -      if (cfg80211_regdomain->dfs_region)
 -              NLA_PUT_U8(msg, NL80211_ATTR_DFS_REGION,
 -                         cfg80211_regdomain->dfs_region);
 +      if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
 +                         cfg80211_regdomain->alpha2) ||
 +          (cfg80211_regdomain->dfs_region &&
 +           nla_put_u8(msg, NL80211_ATTR_DFS_REGION,
 +                      cfg80211_regdomain->dfs_region)))
 +              goto nla_put_failure;
  
        nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
        if (!nl_reg_rules)
                if (!nl_reg_rule)
                        goto nla_put_failure;
  
 -              NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
 -                      reg_rule->flags);
 -              NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
 -                      freq_range->start_freq_khz);
 -              NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
 -                      freq_range->end_freq_khz);
 -              NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
 -                      freq_range->max_bandwidth_khz);
 -              NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
 -                      power_rule->max_antenna_gain);
 -              NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
 -                      power_rule->max_eirp);
 +              if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
 +                              reg_rule->flags) ||
 +                  nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
 +                              freq_range->start_freq_khz) ||
 +                  nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
 +                              freq_range->end_freq_khz) ||
 +                  nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
 +                              freq_range->max_bandwidth_khz) ||
 +                  nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
 +                              power_rule->max_antenna_gain) ||
 +                  nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
 +                              power_rule->max_eirp))
 +                      goto nla_put_failure;
  
                nla_nest_end(msg, nl_reg_rule);
        }
@@@ -4228,44 -4182,37 +4241,44 @@@ static int nl80211_send_bss(struct sk_b
  
        genl_dump_check_consistent(cb, hdr, &nl80211_fam);
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
 +      if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
 +              goto nla_put_failure;
  
        bss = nla_nest_start(msg, NL80211_ATTR_BSS);
        if (!bss)
                goto nla_put_failure;
 -      if (!is_zero_ether_addr(res->bssid))
 -              NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
 -      if (res->information_elements && res->len_information_elements)
 -              NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
 -                      res->len_information_elements,
 -                      res->information_elements);
 -      if (res->beacon_ies && res->len_beacon_ies &&
 -          res->beacon_ies != res->information_elements)
 -              NLA_PUT(msg, NL80211_BSS_BEACON_IES,
 -                      res->len_beacon_ies, res->beacon_ies);
 -      if (res->tsf)
 -              NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
 -      if (res->beacon_interval)
 -              NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
 -      NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
 -      NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
 -      NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
 -              jiffies_to_msecs(jiffies - intbss->ts));
 +      if ((!is_zero_ether_addr(res->bssid) &&
 +           nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)) ||
 +          (res->information_elements && res->len_information_elements &&
 +           nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
 +                   res->len_information_elements,
 +                   res->information_elements)) ||
 +          (res->beacon_ies && res->len_beacon_ies &&
 +           res->beacon_ies != res->information_elements &&
 +           nla_put(msg, NL80211_BSS_BEACON_IES,
 +                   res->len_beacon_ies, res->beacon_ies)))
 +              goto nla_put_failure;
 +      if (res->tsf &&
 +          nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
 +              goto nla_put_failure;
 +      if (res->beacon_interval &&
 +          nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
 +              goto nla_put_failure;
 +      if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
 +          nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
 +          nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
 +                      jiffies_to_msecs(jiffies - intbss->ts)))
 +              goto nla_put_failure;
  
        switch (rdev->wiphy.signal_type) {
        case CFG80211_SIGNAL_TYPE_MBM:
 -              NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
 +              if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
 +                      goto nla_put_failure;
                break;
        case CFG80211_SIGNAL_TYPE_UNSPEC:
 -              NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
 +              if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
 +                      goto nla_put_failure;
                break;
        default:
                break;
        switch (wdev->iftype) {
        case NL80211_IFTYPE_P2P_CLIENT:
        case NL80211_IFTYPE_STATION:
 -              if (intbss == wdev->current_bss)
 -                      NLA_PUT_U32(msg, NL80211_BSS_STATUS,
 -                                  NL80211_BSS_STATUS_ASSOCIATED);
 +              if (intbss == wdev->current_bss &&
 +                  nla_put_u32(msg, NL80211_BSS_STATUS,
 +                              NL80211_BSS_STATUS_ASSOCIATED))
 +                      goto nla_put_failure;
                break;
        case NL80211_IFTYPE_ADHOC:
 -              if (intbss == wdev->current_bss)
 -                      NLA_PUT_U32(msg, NL80211_BSS_STATUS,
 -                                  NL80211_BSS_STATUS_IBSS_JOINED);
 +              if (intbss == wdev->current_bss &&
 +                  nla_put_u32(msg, NL80211_BSS_STATUS,
 +                              NL80211_BSS_STATUS_IBSS_JOINED))
 +                      goto nla_put_failure;
                break;
        default:
                break;
@@@ -4352,43 -4297,34 +4365,43 @@@ static int nl80211_send_survey(struct s
        if (!hdr)
                return -ENOMEM;
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 +      if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
 +              goto nla_put_failure;
  
        infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
        if (!infoattr)
                goto nla_put_failure;
  
 -      NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
 -                  survey->channel->center_freq);
 -      if (survey->filled & SURVEY_INFO_NOISE_DBM)
 -              NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
 -                          survey->noise);
 -      if (survey->filled & SURVEY_INFO_IN_USE)
 -              NLA_PUT_FLAG(msg, NL80211_SURVEY_INFO_IN_USE);
 -      if (survey->filled & SURVEY_INFO_CHANNEL_TIME)
 -              NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
 -                          survey->channel_time);
 -      if (survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
 -              NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
 -                          survey->channel_time_busy);
 -      if (survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
 -              NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
 -                          survey->channel_time_ext_busy);
 -      if (survey->filled & SURVEY_INFO_CHANNEL_TIME_RX)
 -              NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
 -                          survey->channel_time_rx);
 -      if (survey->filled & SURVEY_INFO_CHANNEL_TIME_TX)
 -              NLA_PUT_U64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
 -                          survey->channel_time_tx);
 +      if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
 +                      survey->channel->center_freq))
 +              goto nla_put_failure;
 +
 +      if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
 +          nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
 +              goto nla_put_failure;
 +      if ((survey->filled & SURVEY_INFO_IN_USE) &&
 +          nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
 +              goto nla_put_failure;
 +      if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
 +          nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
 +                      survey->channel_time))
 +              goto nla_put_failure;
 +      if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
 +          nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
 +                      survey->channel_time_busy))
 +              goto nla_put_failure;
 +      if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
 +          nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
 +                      survey->channel_time_ext_busy))
 +              goto nla_put_failure;
 +      if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
 +          nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
 +                      survey->channel_time_rx))
 +              goto nla_put_failure;
 +      if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
 +          nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
 +                      survey->channel_time_tx))
 +              goto nla_put_failure;
  
        nla_nest_end(msg, infoattr);
  
@@@ -5069,7 -5005,7 +5082,7 @@@ static int nl80211_testmode_dump(struc
                                           NL80211_CMD_TESTMODE);
                struct nlattr *tmdata;
  
 -              if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx) < 0) {
 +              if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
                        genlmsg_cancel(skb, hdr);
                        break;
                }
@@@ -5120,8 -5056,7 +5133,8 @@@ __cfg80211_testmode_alloc_skb(struct cf
                return NULL;
        }
  
 -      NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 +      if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
 +              goto nla_put_failure;
        data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
  
        ((void **)skb->cb)[0] = rdev;
@@@ -5500,8 -5435,7 +5513,8 @@@ static int nl80211_remain_on_channel(st
        if (err)
                goto free_msg;
  
 -      NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
 +      if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -5788,8 -5722,7 +5801,8 @@@ static int nl80211_tx_mgmt(struct sk_bu
                goto free_msg;
  
        if (msg) {
 -              NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
 +              if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
 +                      goto nla_put_failure;
  
                genlmsg_end(msg, hdr);
                return genlmsg_reply(msg, info);
@@@ -5894,8 -5827,7 +5907,8 @@@ static int nl80211_get_power_save(struc
        else
                ps_state = NL80211_PS_DISABLED;
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
 +      if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
        return genlmsg_reply(msg, info);
@@@ -6042,21 -5974,20 +6055,21 @@@ static int nl80211_get_wowlan(struct sk
                if (!nl_wowlan)
                        goto nla_put_failure;
  
 -              if (rdev->wowlan->any)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
 -              if (rdev->wowlan->disconnect)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
 -              if (rdev->wowlan->magic_pkt)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
 -              if (rdev->wowlan->gtk_rekey_failure)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE);
 -              if (rdev->wowlan->eap_identity_req)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST);
 -              if (rdev->wowlan->four_way_handshake)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE);
 -              if (rdev->wowlan->rfkill_release)
 -                      NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE);
 +              if ((rdev->wowlan->any &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
 +                  (rdev->wowlan->disconnect &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
 +                  (rdev->wowlan->magic_pkt &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
 +                  (rdev->wowlan->gtk_rekey_failure &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
 +                  (rdev->wowlan->eap_identity_req &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
 +                  (rdev->wowlan->four_way_handshake &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
 +                  (rdev->wowlan->rfkill_release &&
 +                   nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
 +                      goto nla_put_failure;
                if (rdev->wowlan->n_patterns) {
                        struct nlattr *nl_pats, *nl_pat;
                        int i, pat_len;
                                if (!nl_pat)
                                        goto nla_put_failure;
                                pat_len = rdev->wowlan->patterns[i].pattern_len;
 -                              NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_MASK,
 -                                      DIV_ROUND_UP(pat_len, 8),
 -                                      rdev->wowlan->patterns[i].mask);
 -                              NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
 -                                      pat_len,
 -                                      rdev->wowlan->patterns[i].pattern);
 +                              if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
 +                                          DIV_ROUND_UP(pat_len, 8),
 +                                          rdev->wowlan->patterns[i].mask) ||
 +                                  nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
 +                                          pat_len,
 +                                          rdev->wowlan->patterns[i].pattern))
 +                                      goto nla_put_failure;
                                nla_nest_end(msg, nl_pat);
                        }
                        nla_nest_end(msg, nl_pats);
@@@ -6354,8 -6284,7 +6367,8 @@@ static int nl80211_probe_client(struct 
        if (err)
                goto free_msg;
  
 -      NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
 +      if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7023,24 -6952,19 +7036,24 @@@ static int nl80211_add_scan_req(struct 
        nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
        if (!nest)
                goto nla_put_failure;
 -      for (i = 0; i < req->n_ssids; i++)
 -              NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
 +      for (i = 0; i < req->n_ssids; i++) {
 +              if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
 +                      goto nla_put_failure;
 +      }
        nla_nest_end(msg, nest);
  
        nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
        if (!nest)
                goto nla_put_failure;
 -      for (i = 0; i < req->n_channels; i++)
 -              NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
 +      for (i = 0; i < req->n_channels; i++) {
 +              if (nla_put_u32(msg, i, req->channels[i]->center_freq))
 +                      goto nla_put_failure;
 +      }
        nla_nest_end(msg, nest);
  
 -      if (req->ie)
 -              NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
 +      if (req->ie &&
 +          nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
 +              goto nla_put_failure;
  
        return 0;
   nla_put_failure:
@@@ -7059,9 -6983,8 +7072,9 @@@ static int nl80211_send_scan_msg(struc
        if (!hdr)
                return -1;
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
 +              goto nla_put_failure;
  
        /* ignore errors and send incomplete event anyway */
        nl80211_add_scan_req(msg, rdev);
@@@ -7085,9 -7008,8 +7098,9 @@@ nl80211_send_sched_scan_msg(struct sk_b
        if (!hdr)
                return -1;
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
 +              goto nla_put_failure;
  
        return genlmsg_end(msg, hdr);
  
@@@ -7210,33 -7132,26 +7223,33 @@@ void nl80211_send_reg_change_event(stru
        }
  
        /* Userspace can always count this one always being set */
 -      NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
 -
 -      if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
 -              NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
 -                         NL80211_REGDOM_TYPE_WORLD);
 -      else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
 -              NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
 -                         NL80211_REGDOM_TYPE_CUSTOM_WORLD);
 -      else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
 -               request->intersect)
 -              NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
 -                         NL80211_REGDOM_TYPE_INTERSECTION);
 -      else {
 -              NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
 -                         NL80211_REGDOM_TYPE_COUNTRY);
 -              NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
 -      }
 -
 -      if (wiphy_idx_valid(request->wiphy_idx))
 -              NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
 +      if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
 +              goto nla_put_failure;
 +
 +      if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
 +              if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
 +                             NL80211_REGDOM_TYPE_WORLD))
 +                      goto nla_put_failure;
 +      } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
 +              if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
 +                             NL80211_REGDOM_TYPE_CUSTOM_WORLD))
 +                      goto nla_put_failure;
 +      } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
 +                 request->intersect) {
 +              if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
 +                             NL80211_REGDOM_TYPE_INTERSECTION))
 +                      goto nla_put_failure;
 +      } else {
 +              if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
 +                             NL80211_REGDOM_TYPE_COUNTRY) ||
 +                  nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
 +                                 request->alpha2))
 +                      goto nla_put_failure;
 +      }
 +
 +      if (wiphy_idx_valid(request->wiphy_idx) &&
 +          nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7270,10 -7185,9 +7283,10 @@@ static void nl80211_send_mlme_event(str
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          nla_put(msg, NL80211_ATTR_FRAME, len, buf))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7351,11 -7265,10 +7364,11 @@@ static void nl80211_send_mlme_timeout(s
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
 -      NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
 +          nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7403,15 -7316,15 +7416,15 @@@ void nl80211_send_connect_result(struc
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      if (bssid)
 -              NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
 -      NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
 -      if (req_ie)
 -              NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
 -      if (resp_ie)
 -              NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
 +          nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
 +          (req_ie &&
 +           nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
 +          (resp_ie &&
 +           nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7443,14 -7356,13 +7456,14 @@@ void nl80211_send_roamed(struct cfg8021
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
 -      if (req_ie)
 -              NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
 -      if (resp_ie)
 -              NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
 +          (req_ie &&
 +           nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
 +          (resp_ie &&
 +           nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7481,14 -7393,14 +7494,14 @@@ void nl80211_send_disconnected(struct c
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      if (from_ap && reason)
 -              NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
 -      if (from_ap)
 -              NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
 -      if (ie)
 -              NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          (from_ap && reason &&
 +           nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
 +          (from_ap &&
 +           nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
 +          (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7519,10 -7431,9 +7532,10 @@@ void nl80211_send_ibss_bssid(struct cfg
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7553,12 -7464,11 +7566,12 @@@ void nl80211_send_new_peer_candidate(st
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr);
 -      if (ie_len && ie)
 -              NLA_PUT(msg, NL80211_ATTR_IE, ie_len , ie);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
 +          (ie_len && ie &&
 +           nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7589,14 -7499,15 +7602,14 @@@ void nl80211_michael_mic_failure(struc
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      if (addr)
 -              NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
 -      NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
 -      if (key_id != -1)
 -              NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
 -      if (tsc)
 -              NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
 +          nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
 +          (key_id != -1 &&
 +           nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
 +          (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7631,8 -7542,7 +7644,8 @@@ void nl80211_send_beacon_hint_event(str
         * Since we are applying the beacon hint to a wiphy we know its
         * wiphy_idx is valid
         */
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
 +              goto nla_put_failure;
  
        /* Before */
        nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
@@@ -7684,16 -7594,14 +7697,16 @@@ static void nl80211_send_remain_on_chan
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
 -      NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
 +          nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type) ||
 +          nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
 +              goto nla_put_failure;
  
 -      if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
 -              NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
 +      if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
 +          nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7764,9 -7672,8 +7777,9 @@@ void nl80211_send_sta_del_event(struct 
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 -      NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 +      if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 +          nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7802,10 -7709,9 +7815,10 @@@ static bool __nl80211_unexpected_frame(
                return true;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 -      NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 +          nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
 +              goto nla_put_failure;
  
        err = genlmsg_end(msg, hdr);
        if (err < 0) {
@@@ -7854,13 -7760,12 +7867,13 @@@ int nl80211_send_mgmt(struct cfg80211_r
                return -ENOMEM;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
 -      if (sig_dbm)
 -              NLA_PUT_U32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm);
 -      NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
 +          (sig_dbm &&
 +           nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
 +          nla_put(msg, NL80211_ATTR_FRAME, len, buf))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7890,12 -7795,12 +7903,12 @@@ void nl80211_send_mgmt_tx_status(struc
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
 -      NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
 -      if (ack)
 -              NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
 +          nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
 +          (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -7927,17 -7832,15 +7940,17 @@@ nl80211_send_cqm_rssi_notify(struct cfg
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
 +              goto nla_put_failure;
  
        pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
        if (!pinfoattr)
                goto nla_put_failure;
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
 -                  rssi_event);
 +      if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
 +                      rssi_event))
 +              goto nla_put_failure;
  
        nla_nest_end(msg, pinfoattr);
  
@@@ -7970,18 -7873,16 +7983,18 @@@ void nl80211_gtk_rekey_notify(struct cf
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
 +              goto nla_put_failure;
  
        rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
        if (!rekey_attr)
                goto nla_put_failure;
  
 -      NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR,
 -              NL80211_REPLAY_CTR_LEN, replay_ctr);
 +      if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
 +                  NL80211_REPLAY_CTR_LEN, replay_ctr))
 +              goto nla_put_failure;
  
        nla_nest_end(msg, rekey_attr);
  
@@@ -8014,19 -7915,17 +8027,19 @@@ void nl80211_pmksa_candidate_notify(str
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
 +              goto nla_put_failure;
  
        attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
        if (!attr)
                goto nla_put_failure;
  
 -      NLA_PUT_U32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index);
 -      NLA_PUT(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid);
 -      if (preauth)
 -              NLA_PUT_FLAG(msg, NL80211_PMKSA_CANDIDATE_PREAUTH);
 +      if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
 +          nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
 +          (preauth &&
 +           nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
 +              goto nla_put_failure;
  
        nla_nest_end(msg, attr);
  
@@@ -8058,10 -7957,9 +8071,10 @@@ void nl80211_ch_switch_notify(struct cf
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, type);
 +      if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
 +          nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, type))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);
  
@@@ -8093,17 -7991,15 +8106,17 @@@ nl80211_send_cqm_pktloss_notify(struct 
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 -      NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
 +          nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
 +              goto nla_put_failure;
  
        pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
        if (!pinfoattr)
                goto nla_put_failure;
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets);
 +      if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
 +              goto nla_put_failure;
  
        nla_nest_end(msg, pinfoattr);
  
@@@ -8137,12 -8033,12 +8150,12 @@@ void cfg80211_probe_status(struct net_d
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 -      NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
 -      NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
 -      if (acked)
 -              NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 +          nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
 +          nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
 +          (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
 +              goto nla_put_failure;
  
        err = genlmsg_end(msg, hdr);
        if (err < 0) {
@@@ -8182,13 -8078,12 +8195,13 @@@ void cfg80211_report_obss_beacon(struc
                return;
        }
  
 -      NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 -      if (freq)
 -              NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
 -      if (sig_dbm)
 -              NLA_PUT_U32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm);
 -      NLA_PUT(msg, NL80211_ATTR_FRAME, len, frame);
 +      if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 +          (freq &&
 +           nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
 +          (sig_dbm &&
 +           nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
 +          nla_put(msg, NL80211_ATTR_FRAME, len, frame))
 +              goto nla_put_failure;
  
        genlmsg_end(msg, hdr);