Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

5 files changed, 18 insertions, 5 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index b0102c538b30..facf233843e0 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1389,6 +1389,9 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_conf *conf = &local->hw.conf;
 
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
                 return -EOPNOTSUPP;
 
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index fe140bf033f9..edf21cebeee8 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -684,21 +684,25 @@ static u16 ieee80211_monitor_select_queue(struct net_device *dev,
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_hdr *hdr;
         struct ieee80211_radiotap_header *rtap = (void *)skb->data;
+        u8 *p;
 
         if (local->hw.queues < 4)
                 return 0;
 
         if (skb->len < 4 ||
-            skb->len < rtap->it_len + 2 /* frame control */)
+            skb->len < le16_to_cpu(rtap->it_len) + 2 /* frame control */)
                 return 0; /* doesn't matter, frame will be dropped */
 
-        hdr = (void *)((u8 *)skb->data + rtap->it_len);
+        hdr = (void *)((u8 *)skb->data + le16_to_cpu(rtap->it_len));
 
-        if (!ieee80211_is_data(hdr->frame_control)) {
+        if (!ieee80211_is_data_qos(hdr->frame_control)) {
                 skb->priority = 7;
                 return ieee802_1d_to_ac[skb->priority];
         }
 
+        p = ieee80211_get_qos_ctl(hdr);
+        skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
+
         return ieee80211_downgrade_queue(local, skb);
 }
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a82564e73d91..1e1d16c55ee5 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1478,7 +1478,9 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                         rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
                         break;
                 case IEEE80211_STYPE_ACTION:
-                        /* XXX: differentiate, can only happen for CSA now! */
+                        if (mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
+                                break;
+
                         ieee80211_sta_process_chanswitch(sdata,
                                         &mgmt->u.action.u.chan_switch.sw_elem,
                                         (void *)ifmgd->associated->priv);
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 699d3ed869c4..29bc4c516238 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -190,7 +190,7 @@ static void rate_control_pid_sample(struct rc_pid_info *pinfo,
         rate_control_pid_normalize(pinfo, sband->n_bitrates);
 
         /* Compute the proportional, integral and derivative errors. */
-        err_prop = (pinfo->target << RC_PID_ARITH_SHIFT) - pf;
+        err_prop = (pinfo->target - pf) << RC_PID_ARITH_SHIFT;
 
         err_avg = spinfo->err_avg_sc >> pinfo->smoothing_shift;
         spinfo->err_avg_sc = spinfo->err_avg_sc - err_avg + err_prop;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index efa6d3689c5e..a8e15b84c05b 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1946,6 +1946,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 }
                 break;
         default:
+                /* do not process rejected action frames */
+                if (mgmt->u.action.category & 0x80)
+                        return RX_DROP_MONITOR;
+
                 return RX_CONTINUE;
         }