1 files changed, 8 insertions, 11 deletions

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 3b7a750ebc70..79a89fe9d616 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1311,18 +1311,15 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
             !ieee80211_has_morefrags(hdr->frame_control) &&
             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
-             rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
+             rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
+            /* PM bit is only checked in frames where it isn't reserved,
+             * in AP mode it's reserved in non-bufferable management frames
+             * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
+             */
+            (!ieee80211_is_mgmt(hdr->frame_control) ||
+             ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
                 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
-                        /*
-                         * Ignore doze->wake transitions that are
-                         * indicated by non-data frames, the standard
-                         * is unclear here, but for example going to
-                         * PS mode and then scanning would cause a
-                         * doze->wake transition for the probe request,
-                         * and that is clearly undesirable.
-                         */
-                        if (ieee80211_is_data(hdr->frame_control) &&
-                            !ieee80211_has_pm(hdr->frame_control))
+                        if (!ieee80211_has_pm(hdr->frame_control))
                                 sta_ps_end(sta);
                 } else {
                         if (ieee80211_has_pm(hdr->frame_control))