1 files changed, 23 insertions, 15 deletions

diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 5e3a7eccef5a..5538e1b4a697 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -58,17 +58,17 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
 
         if (!skb) {
                 printk(KERN_ERR "%s: failed to allocate buffer "
-                                "for addba request frame\n", sdata->dev->name);
+                                "for addba request frame\n", sdata->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
 
@@ -104,7 +104,7 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
         skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
         if (!skb) {
                 printk(KERN_ERR "%s: failed to allocate buffer for "
-                        "bar frame\n", sdata->dev->name);
+                        "bar frame\n", sdata->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
@@ -113,7 +113,7 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
         bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
                                          IEEE80211_STYPE_BACK_REQ);
         memcpy(bar->ra, ra, ETH_ALEN);
-        memcpy(bar->ta, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(bar->ta, sdata->vif.addr, ETH_ALEN);
         bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
         bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
         bar_control |= (u16)(tid << 12);
@@ -144,7 +144,7 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
         *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
 
-        ret = drv_ampdu_action(local, &sta->sdata->vif,
+        ret = drv_ampdu_action(local, sta->sdata,
                                IEEE80211_AMPDU_TX_STOP,
                                &sta->sta, tid, NULL);
 
@@ -179,7 +179,8 @@ static void sta_addba_resp_timer_expired(unsigned long data)
 
         /* check if the TID waits for addBA response */
         spin_lock_bh(&sta->lock);
-        if ((*state & (HT_ADDBA_REQUESTED_MSK | HT_ADDBA_RECEIVED_MSK)) !=
+        if ((*state & (HT_ADDBA_REQUESTED_MSK | HT_ADDBA_RECEIVED_MSK |
+                       HT_AGG_STATE_REQ_STOP_BA_MSK)) !=
                                                 HT_ADDBA_REQUESTED_MSK) {
                 spin_unlock_bh(&sta->lock);
                 *state = HT_AGG_STATE_IDLE;
@@ -236,6 +237,14 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
             sdata->vif.type != NL80211_IFTYPE_AP)
                 return -EINVAL;
 
+        if (test_sta_flags(sta, WLAN_STA_DISASSOC)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Disassociation is in progress. "
+                       "Denying BA session request\n");
+#endif
+                return -EINVAL;
+        }
+
         if (test_sta_flags(sta, WLAN_STA_SUSPEND)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Suspend in progress. "
@@ -301,10 +310,9 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
          * call back right away, it must see that the flow has begun */
         *state |= HT_ADDBA_REQUESTED_MSK;
 
-        start_seq_num = sta->tid_seq[tid];
+        start_seq_num = sta->tid_seq[tid] >> 4;
 
-        ret = drv_ampdu_action(local, &sdata->vif,
-                               IEEE80211_AMPDU_TX_START,
+        ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START,
                                pubsta, tid, &start_seq_num);
 
         if (ret) {
@@ -420,7 +428,7 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
         ieee80211_agg_splice_finish(local, sta, tid);
         spin_unlock(&local->ampdu_lock);
 
-        drv_ampdu_action(local, &sta->sdata->vif,
+        drv_ampdu_action(local, sta->sdata,
                          IEEE80211_AMPDU_TX_OPERATIONAL,
                          &sta->sta, tid, NULL);
 }
@@ -441,7 +449,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
         }
 
         rcu_read_lock();
-        sta = sta_info_get(local, ra);
+        sta = sta_info_get(sdata, ra);
         if (!sta) {
                 rcu_read_unlock();
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -489,7 +497,7 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping start BA session", skb->dev->name);
+                               "dropping start BA session", sdata->name);
 #endif
                 return;
         }
@@ -564,7 +572,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         rcu_read_lock();
-        sta = sta_info_get(local, ra);
+        sta = sta_info_get(sdata, ra);
         if (!sta) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Could not find station: %pM\n", ra);
@@ -621,7 +629,7 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping stop BA session", skb->dev->name);
+                               "dropping stop BA session", sdata->name);
 #endif
                 return;
         }