1 files changed, 6 insertions, 11 deletions

diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 73ac607beb5d..6a381cbe1e33 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1255,13 +1255,12 @@ int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata,
 }
 
 static int mesh_fwd_csa_frame(struct ieee80211_sub_if_data *sdata,
-                               struct ieee80211_mgmt *mgmt, size_t len)
+                               struct ieee80211_mgmt *mgmt, size_t len,
+                               struct ieee802_11_elems *elems)
 {
         struct ieee80211_mgmt *mgmt_fwd;
         struct sk_buff *skb;
         struct ieee80211_local *local = sdata->local;
-        u8 *pos = mgmt->u.action.u.chan_switch.variable;
-        size_t offset_ttl;
 
         skb = dev_alloc_skb(local->tx_headroom + len);
         if (!skb)
@@ -1269,13 +1268,9 @@ static int mesh_fwd_csa_frame(struct ieee80211_sub_if_data *sdata,
         skb_reserve(skb, local->tx_headroom);
         mgmt_fwd = skb_put(skb, len);
 
-        /* offset_ttl is based on whether the secondary channel
-         * offset is available or not. Subtract 1 from the mesh TTL
-         * and disable the initiator flag before forwarding.
-         */
-        offset_ttl = (len < 42) ? 7 : 10;
-        *(pos + offset_ttl) -= 1;
-        *(pos + offset_ttl + 1) &= ~WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
+        elems->mesh_chansw_params_ie->mesh_ttl--;
+        elems->mesh_chansw_params_ie->mesh_flags &=
+                ~WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
 
         memcpy(mgmt_fwd, mgmt, len);
         eth_broadcast_addr(mgmt_fwd->da);
@@ -1323,7 +1318,7 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
 
         /* forward or re-broadcast the CSA frame */
         if (fwd_csa) {
-                if (mesh_fwd_csa_frame(sdata, mgmt, len) < 0)
+                if (mesh_fwd_csa_frame(sdata, mgmt, len, &elems) < 0)
                         mcsa_dbg(sdata, "Failed to forward the CSA frame");
         }
 }