11 files changed, 43 insertions, 27 deletions

diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index bd765f30dba..b09948ceec4 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -666,26 +666,25 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 
         state = &sta->ampdu_mlme.tid_state_tx[tid];
 
+        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+
         spin_lock_bh(&sta->lock);
 
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-                spin_unlock_bh(&sta->lock);
-                return;
-        }
+        if (!(*state & HT_ADDBA_REQUESTED_MSK))
+                goto timer_still_needed;
 
         if (mgmt->u.action.u.addba_resp.dialog_token !=
                 sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
-                spin_unlock_bh(&sta->lock);
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
-                return;
+                goto timer_still_needed;
         }
 
-        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
+
         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
                         == WLAN_STATUS_SUCCESS) {
                 u8 curstate = *state;
@@ -699,5 +698,11 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
         } else {
                 ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR);
         }
+
+        goto out;
+
+ timer_still_needed:
+        add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+ out:
         spin_unlock_bh(&sta->lock);
 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 5608f6c6841..7b5131bd6fa 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -72,6 +72,9 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
         struct ieee80211_sub_if_data *sdata;
         int ret;
 
+        if (netif_running(dev))
+                return -EBUSY;
+
         if (!nl80211_type_check(type))
                 return -EINVAL;
 
@@ -81,9 +84,6 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
         if (ret)
                 return ret;
 
-        if (netif_running(sdata->dev))
-                return -EBUSY;
-
         if (ieee80211_vif_is_mesh(&sdata->vif) && params->mesh_id_len)
                 ieee80211_sdata_set_mesh_id(sdata,
                                             params->mesh_id_len,
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 0891bfb0699..48ef1a282b9 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -153,7 +153,7 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
         if (net_ratelimit())
                 printk(KERN_DEBUG "delba from %pM (%s) tid %d reason code %d\n",
                         mgmt->sa, initiator ? "initiator" : "recipient", tid,
-                        mgmt->u.action.u.delba.reason_code);
+                        le16_to_cpu(mgmt->u.action.u.delba.reason_code));
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         if (initiator == WLAN_BACK_INITIATOR)
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 920ec8792f4..f1362f32c17 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -73,6 +73,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         u8 *pos;
         struct ieee80211_supported_band *sband;
+        struct cfg80211_bss *bss;
         u32 bss_change;
         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
 
@@ -177,8 +178,9 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         mod_timer(&ifibss->timer,
                   round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
 
-        cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
-                                  mgmt, skb->len, 0, GFP_KERNEL);
+        bss = cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
+                                        mgmt, skb->len, 0, GFP_KERNEL);
+        cfg80211_put_bss(bss);
         cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
 }
 
@@ -538,13 +540,12 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                                        WLAN_CAPABILITY_PRIVACY,
                                        capability);
 
+        if (bss) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-        if (bss)
                 printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
                        "%pM\n", bss->cbss.bssid, ifibss->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
-        if (bss && memcmp(ifibss->bssid, bss->cbss.bssid, ETH_ALEN)) {
                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
                        " based on configured SSID\n",
                        sdata->dev->name, bss->cbss.bssid);
@@ -552,8 +553,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 ieee80211_sta_join_ibss(sdata, bss);
                 ieee80211_rx_bss_put(local, bss);
                 return;
-        } else if (bss)
-                ieee80211_rx_bss_put(local, bss);
+        }
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "   did not try to join ibss\n");
@@ -829,7 +829,7 @@ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
                 if (!sdata->u.ibss.ssid_len)
                         continue;
                 sdata->u.ibss.last_scan_completed = jiffies;
-                ieee80211_sta_find_ibss(sdata);
+                mod_timer(&sdata->u.ibss.timer, 0);
         }
         mutex_unlock(&local->iflist_mtx);
 }
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index e12a786e26b..29b82e98eff 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -259,7 +259,7 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
  * @hwmp_ie: hwmp information element (PREP or PREQ)
  *
  * This function updates the path routing information to the originator and the
- * transmitter of a HWMP PREQ or PREP fram.
+ * transmitter of a HWMP PREQ or PREP frame.
  *
  * Returns: metric to frame originator or 0 if the frame should not be further
  * processed
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 8d26e9bf896..dc5049d58c5 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1457,8 +1457,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         if (status_code != WLAN_STATUS_SUCCESS) {
                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
                        sdata->dev->name, status_code);
-                list_del(&wk->list);
-                kfree(wk);
+                wk->state = IEEE80211_MGD_STATE_IDLE;
                 return RX_MGMT_CFG80211_ASSOC;
         }
 
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index a59043fbb0f..45667054a5f 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -6,6 +6,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/poll.h>
 #include <linux/netdevice.h>
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c01588f9d45..7170bf4565a 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2164,11 +2164,17 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 
         skb = rx.skb;
 
-        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+        if (rx.sdata && ieee80211_is_data(hdr->frame_control)) {
+                rx.flags |= IEEE80211_RX_RA_MATCH;
+                prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
+                if (prepares)
+                        prev = rx.sdata;
+        } else list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 if (!netif_running(sdata->dev))
                         continue;
 
-                if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                         continue;
 
                 rx.flags |= IEEE80211_RX_RA_MATCH;
@@ -2447,6 +2453,8 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ieee80211_supported_band *sband;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
+        WARN_ON_ONCE(softirq_count() == 0);
+
         if (WARN_ON(status->band < 0 ||
                     status->band >= IEEE80211_NUM_BANDS))
                 goto drop;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index eec001491e6..594f2318c3d 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -361,6 +361,7 @@ int sta_info_insert(struct sta_info *sta)
                                              u.ap);
 
                 drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD, &sta->sta);
+                sdata = sta->sdata;
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -496,6 +497,7 @@ static void __sta_info_unlink(struct sta_info **sta)
 
                 drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
                                &(*sta)->sta);
+                sdata = (*sta)->sdata;
         }
 
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index fd402829661..eaa4118de98 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1445,7 +1445,7 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                                 if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
                                         continue;
                                 if (compare_ether_addr(tmp_sdata->dev->dev_addr,
-                                                       hdr->addr2)) {
+                                                       hdr->addr2) == 0) {
                                         dev_hold(tmp_sdata->dev);
                                         dev_put(sdata->dev);
                                         sdata = tmp_sdata;
@@ -1704,7 +1704,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         if (!is_multicast_ether_addr(hdr.addr1)) {
                 rcu_read_lock();
                 sta = sta_info_get(local, hdr.addr1);
-                if (sta)
+                /* XXX: in the future, use sdata to look up the sta */
+                if (sta && sta->sdata == sdata)
                         sta_flags = get_sta_flags(sta);
                 rcu_read_unlock();
         }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index dd656432136..aeb65b3d229 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -339,7 +339,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         if (WARN_ON(!info->control.vif)) {
-                kfree(skb);
+                kfree_skb(skb);
                 return;
         }
 
@@ -367,7 +367,7 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
                 if (WARN_ON(!info->control.vif)) {
-                        kfree(skb);
+                        kfree_skb(skb);
                         continue;
                 }