Merge branch 'for-john' of git://git.sipsolutions.net/mac80211-next

1 files changed, 4 insertions, 6 deletions

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index a0b7cfd34685..5bddf53ece1d 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -678,8 +678,7 @@ static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
                         continue;
 
                 if (data2->idle || !data2->started ||
-                    !hwsim_ps_rx_ok(data2, skb) ||
-                    !data->channel || !data2->channel ||
+                    !hwsim_ps_rx_ok(data2, skb) || !data2->channel ||
                     data->channel->center_freq != data2->channel->center_freq ||
                     !(data->group & data2->group))
                         continue;
@@ -1486,7 +1485,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
         struct mac80211_hwsim_data *data2;
         struct ieee80211_tx_info *txi;
         struct hwsim_tx_rate *tx_attempts;
-        struct sk_buff __user *ret_skb;
+        unsigned long ret_skb_ptr;
         struct sk_buff *skb, *tmp;
         struct mac_address *src;
         unsigned int hwsim_flags;
@@ -1504,8 +1503,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
                                    info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
         hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
 
-        ret_skb = (struct sk_buff __user *)
-                  (unsigned long) nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
+        ret_skb_ptr = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
 
         data2 = get_hwsim_data_ref_from_addr(src);
 
@@ -1514,7 +1512,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
 
         /* look for the skb matching the cookie passed back from user */
         skb_queue_walk_safe(&data2->pending, skb, tmp) {
-                if (skb == ret_skb) {
+                if ((unsigned long)skb == ret_skb_ptr) {
                         skb_unlink(skb, &data2->pending);
                         found = true;
                         break;