Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/linville/wireless-2.6

3 files changed, 27 insertions, 5 deletions

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 6b75cb6c6300..a5e5c31c23ab 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2248,10 +2248,13 @@ static void ieee80211_rx_bss_put(struct net_device *dev,
                                  struct ieee80211_sta_bss *bss)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        if (!atomic_dec_and_test(&bss->users))
+
+        local_bh_disable();
+        if (!atomic_dec_and_lock(&bss->users, &local->sta_bss_lock)) {
+                local_bh_enable();
                 return;
+        }
 
-        spin_lock_bh(&local->sta_bss_lock);
         __ieee80211_rx_bss_hash_del(dev, bss);
         list_del(&bss->list);
         spin_unlock_bh(&local->sta_bss_lock);
@@ -2709,7 +2712,26 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                         bss->wmm_ie_len = elems.wmm_param_len + 2;
                 } else
                         bss->wmm_ie_len = 0;
-        } else if (!elems.wmm_param && bss->wmm_ie) {
+        } else if (elems.wmm_info &&
+                    (!bss->wmm_ie || bss->wmm_ie_len != elems.wmm_info_len ||
+                     memcmp(bss->wmm_ie, elems.wmm_info, elems.wmm_info_len))) {
+                 /* As for certain AP's Fifth bit is not set in WMM IE in
+                  * beacon frames.So while parsing the beacon frame the
+                  * wmm_info structure is used instead of wmm_param.
+                  * wmm_info structure was never used to set bss->wmm_ie.
+                  * This code fixes this problem by copying the WME
+                  * information from wmm_info to bss->wmm_ie and enabling
+                  * n-band association.
+                  */
+                kfree(bss->wmm_ie);
+                bss->wmm_ie = kmalloc(elems.wmm_info_len + 2, GFP_ATOMIC);
+                if (bss->wmm_ie) {
+                        memcpy(bss->wmm_ie, elems.wmm_info - 2,
+                               elems.wmm_info_len + 2);
+                        bss->wmm_ie_len = elems.wmm_info_len + 2;
+                } else
+                        bss->wmm_ie_len = 0;
+        } else if (!elems.wmm_param && !elems.wmm_info && bss->wmm_ie) {
                 kfree(bss->wmm_ie);
                 bss->wmm_ie = NULL;
                 bss->wmm_ie_len = 0;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 52e4554fdde7..02f436a86061 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2170,7 +2170,7 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
         struct ieee80211_supported_band *sband;
 
         if (status->band < 0 ||
-            status->band > IEEE80211_NUM_BANDS) {
+            status->band >= IEEE80211_NUM_BANDS) {
                 WARN_ON(1);
                 return;
         }
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 4e94e4026e78..64faa3dc488f 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -709,7 +709,7 @@ void ieee80211_requeue(struct ieee80211_local *local, int queue)
         struct ieee80211_sched_data *q = qdisc_priv(root_qd);
         struct Qdisc *qdisc = q->queues[queue];
         struct sk_buff *skb = NULL;
-        u32 len = qdisc->q.qlen;
+        u32 len;
 
         if (!qdisc || !qdisc->dequeue)
                 return;