2 files changed, 21 insertions, 6 deletions

diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 52e15e079c61..0aa831467493 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -472,7 +472,7 @@ static inline int ieee80211_is_cfendack(__le16 fc)
 }
 
 /**
- * ieee80211_is_nullfunc - check if FTYPE=IEEE80211_FTYPE_DATA and STYPE=IEEE80211_STYPE_NULLFUNC
+ * ieee80211_is_nullfunc - check if frame is a regular (non-QoS) nullfunc frame
  * @fc: frame control bytes in little-endian byteorder
  */
 static inline int ieee80211_is_nullfunc(__le16 fc)
@@ -481,6 +481,16 @@ static inline int ieee80211_is_nullfunc(__le16 fc)
                cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC);
 }
 
+/**
+ * ieee80211_is_qos_nullfunc - check if frame is a QoS nullfunc frame
+ * @fc: frame control bytes in little-endian byteorder
+ */
+static inline int ieee80211_is_qos_nullfunc(__le16 fc)
+{
+        return (fc & cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
+               cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_NULLFUNC);
+}
+
 struct ieee80211s_hdr {
         u8 flags;
         u8 ttl;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index f862399f7ce1..51cb8bc3af81 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -886,12 +886,17 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                 }
         }
 
-        /* Drop data::nullfunc frames silently, since they are used only to
-         * control station power saving mode. */
-        if (ieee80211_is_nullfunc(hdr->frame_control)) {
+        /*
+         * Drop (qos-)data::nullfunc frames silently, since they
+         * are used only to control station power saving mode.
+         */
+        if (ieee80211_is_nullfunc(hdr->frame_control) ||
+            ieee80211_is_qos_nullfunc(hdr->frame_control)) {
                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
-                /* Update counter and free packet here to avoid counting this
-                 * as a dropped packed. */
+                /*
+                 * Update counter and free packet here to avoid
+                 * counting this as a dropped packed.
+                 */
                 sta->rx_packets++;
                 dev_kfree_skb(rx->skb);
                 return RX_QUEUED;