4 files changed, 34 insertions, 8 deletions

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 72c8bea81a6c..b1b1bb368f70 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1487,6 +1487,7 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         int i, j, err;
         bool have_higher_than_11mbit = false;
         u16 ap_ht_cap_flags;
+        int min_rate = INT_MAX, min_rate_index = -1;
 
         /* AssocResp and ReassocResp have identical structure */
 
@@ -1553,6 +1554,10 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
                                 rates |= BIT(j);
                                 if (is_basic)
                                         basic_rates |= BIT(j);
+                                if (rate < min_rate) {
+                                        min_rate = rate;
+                                        min_rate_index = j;
+                                }
                                 break;
                         }
                 }
@@ -1570,11 +1575,25 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
                                 rates |= BIT(j);
                                 if (is_basic)
                                         basic_rates |= BIT(j);
+                                if (rate < min_rate) {
+                                        min_rate = rate;
+                                        min_rate_index = j;
+                                }
                                 break;
                         }
                 }
         }
 
+        /*
+         * some buggy APs don't advertise basic_rates. use the lowest
+         * supported rate instead.
+         */
+        if (unlikely(!basic_rates) && min_rate_index >= 0) {
+                printk(KERN_DEBUG "%s: No basic rates in AssocResp. "
+                       "Using min supported rate instead.\n", sdata->name);
+                basic_rates = BIT(min_rate_index);
+        }
+
         sta->sta.supp_rates[wk->chan->band] = rates;
         sdata->vif.bss_conf.basic_rates = basic_rates;
 
@@ -2269,6 +2288,7 @@ void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
 
         cancel_work_sync(&ifmgd->request_smps_work);
 
+        cancel_work_sync(&ifmgd->monitor_work);
         cancel_work_sync(&ifmgd->beacon_connection_loss_work);
         if (del_timer_sync(&ifmgd->timer))
                 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
@@ -2277,7 +2297,6 @@ void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
         if (del_timer_sync(&ifmgd->chswitch_timer))
                 set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
 
-        cancel_work_sync(&ifmgd->monitor_work);
         /* these will just be re-established on connection */
         del_timer_sync(&ifmgd->conn_mon_timer);
         del_timer_sync(&ifmgd->bcn_mon_timer);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index bb53726cb04a..fb123e2e081a 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -141,8 +141,9 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         pos++;
 
         /* IEEE80211_RADIOTAP_RATE */
-        if (status->flag & RX_FLAG_HT) {
+        if (!rate || status->flag & RX_FLAG_HT) {
                 /*
+                 * Without rate information don't add it. If we have,
                  * MCS information is a separate field in radiotap,
                  * added below. The byte here is needed as padding
                  * for the channel though, so initialise it to 0.
@@ -163,12 +164,14 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         else if (status->flag & RX_FLAG_HT)
                 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
                                    pos);
-        else if (rate->flags & IEEE80211_RATE_ERP_G)
+        else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
                 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
                                    pos);
-        else
+        else if (rate)
                 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
                                    pos);
+        else
+                put_unaligned_le16(IEEE80211_CHAN_2GHZ, pos);
         pos += 2;
 
         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index ce962d2c8782..8eaa746ec7a2 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1354,12 +1354,12 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                          * Use MoreData flag to indicate whether there are
                          * more buffered frames for this STA
                          */
-                        if (!more_data)
-                                hdr->frame_control &=
-                                        cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
-                        else
+                        if (more_data || !skb_queue_empty(&frames))
                                 hdr->frame_control |=
                                         cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+                        else
+                                hdr->frame_control &=
+                                        cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
 
                         if (ieee80211_is_data_qos(hdr->frame_control) ||
                             ieee80211_is_qos_nullfunc(hdr->frame_control))
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 51e256c5fb78..eca0fad09709 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -881,6 +881,8 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         skb = ieee80211_probereq_get(&local->hw, &sdata->vif,
                                      ssid, ssid_len,
                                      buf, buf_len);
+        if (!skb)
+                goto out;
 
         if (dst) {
                 mgmt = (struct ieee80211_mgmt *) skb->data;
@@ -889,6 +891,8 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         }
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+
+ out:
         kfree(buf);
 
         return skb;