4 files changed, 30 insertions, 3 deletions

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 62b9feb3c804..d7afd0956970 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -134,7 +134,8 @@ static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *d
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        if (sdata->vif.type == NL80211_IFTYPE_AP)
+        if (sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
         else
                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 6ab731fecc20..c91b32a3f0e7 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -41,7 +41,8 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        if (sdata->vif.type == NL80211_IFTYPE_AP)
+        if (sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
         else
                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
@@ -180,6 +181,19 @@ int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
                 goto exit;
         }
 
+        /*
+         * The aggregation code is not prepared to handle
+         * anything but STA/AP due to the BSSID handling.
+         * IBSS could work in the code but isn't supported
+         * by drivers or the standard.
+         */
+        if (sta->sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sta->sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+            sta->sdata->vif.type != NL80211_IFTYPE_AP) {
+                ret = -EINVAL;
+                goto exit;
+        }
+
         spin_lock_bh(&sta->lock);
 
         /* we have tried too many times, receiver does not want A-MPDU */
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 869ea5fd3f51..a49a8a5828bf 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -190,7 +190,8 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        if (sdata->vif.type == NL80211_IFTYPE_AP)
+        if (sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
         else
                 memcpy(mgmt->bssid, ifsta->bssid, ETH_ALEN);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index f34cc66d3f4b..1327d424bf31 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1768,6 +1768,17 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
 
         switch (mgmt->u.action.category) {
         case WLAN_CATEGORY_BACK:
+                /*
+                 * The aggregation code is not prepared to handle
+                 * anything but STA/AP due to the BSSID handling;
+                 * IBSS could work in the code but isn't supported
+                 * by drivers or the standard.
+                 */
+                if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+                    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_AP)
+                        return RX_DROP_MONITOR;
+
                 switch (mgmt->u.action.u.addba_req.action_code) {
                 case WLAN_ACTION_ADDBA_REQ:
                         if (len < (IEEE80211_MIN_ACTION_SIZE +