7 files changed, 25 insertions, 21 deletions

diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index bd765f30dba2..b09948ceec4a 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -666,26 +666,25 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 
         state = &sta->ampdu_mlme.tid_state_tx[tid];
 
+        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+
         spin_lock_bh(&sta->lock);
 
-        if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
-                spin_unlock_bh(&sta->lock);
-                return;
-        }
+        if (!(*state & HT_ADDBA_REQUESTED_MSK))
+                goto timer_still_needed;
 
         if (mgmt->u.action.u.addba_resp.dialog_token !=
                 sta->ampdu_mlme.tid_tx[tid]->dialog_token) {
-                spin_unlock_bh(&sta->lock);
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "wrong addBA response token, tid %d\n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
-                return;
+                goto timer_still_needed;
         }
 
-        del_timer_sync(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "switched off addBA timer for tid %d \n", tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
+
         if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
                         == WLAN_STATUS_SUCCESS) {
                 u8 curstate = *state;
@@ -699,5 +698,11 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
         } else {
                 ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR);
         }
+
+        goto out;
+
+ timer_still_needed:
+        add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
+ out:
         spin_unlock_bh(&sta->lock);
 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 5608f6c68413..7b5131bd6fa1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -72,6 +72,9 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
         struct ieee80211_sub_if_data *sdata;
         int ret;
 
+        if (netif_running(dev))
+                return -EBUSY;
+
         if (!nl80211_type_check(type))
                 return -EINVAL;
 
@@ -81,9 +84,6 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
         if (ret)
                 return ret;
 
-        if (netif_running(sdata->dev))
-                return -EBUSY;
-
         if (ieee80211_vif_is_mesh(&sdata->vif) && params->mesh_id_len)
                 ieee80211_sdata_set_mesh_id(sdata,
                                             params->mesh_id_len,
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 0891bfb06996..48ef1a282b91 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -153,7 +153,7 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
         if (net_ratelimit())
                 printk(KERN_DEBUG "delba from %pM (%s) tid %d reason code %d\n",
                         mgmt->sa, initiator ? "initiator" : "recipient", tid,
-                        mgmt->u.action.u.delba.reason_code);
+                        le16_to_cpu(mgmt->u.action.u.delba.reason_code));
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         if (initiator == WLAN_BACK_INITIATOR)
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 6eaf69823439..f1362f32c17d 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -73,6 +73,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         u8 *pos;
         struct ieee80211_supported_band *sband;
+        struct cfg80211_bss *bss;
         u32 bss_change;
         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
 
@@ -177,8 +178,9 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         mod_timer(&ifibss->timer,
                   round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
 
-        cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
-                                  mgmt, skb->len, 0, GFP_KERNEL);
+        bss = cfg80211_inform_bss_frame(local->hw.wiphy, local->hw.conf.channel,
+                                        mgmt, skb->len, 0, GFP_KERNEL);
+        cfg80211_put_bss(bss);
         cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
 }
 
@@ -538,13 +540,12 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                                        WLAN_CAPABILITY_PRIVACY,
                                        capability);
 
+        if (bss) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
-        if (bss)
                 printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
                        "%pM\n", bss->cbss.bssid, ifibss->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
-        if (bss && !memcmp(ifibss->bssid, bss->cbss.bssid, ETH_ALEN)) {
                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
                        " based on configured SSID\n",
                        sdata->dev->name, bss->cbss.bssid);
@@ -552,8 +553,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 ieee80211_sta_join_ibss(sdata, bss);
                 ieee80211_rx_bss_put(local, bss);
                 return;
-        } else if (bss)
-                ieee80211_rx_bss_put(local, bss);
+        }
 
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "   did not try to join ibss\n");
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index e12a786e26b8..29b82e98effa 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -259,7 +259,7 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
  * @hwmp_ie: hwmp information element (PREP or PREQ)
  *
  * This function updates the path routing information to the originator and the
- * transmitter of a HWMP PREQ or PREP fram.
+ * transmitter of a HWMP PREQ or PREP frame.
  *
  * Returns: metric to frame originator or 0 if the frame should not be further
  * processed
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 8d26e9bf8964..dc5049d58c51 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1457,8 +1457,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         if (status_code != WLAN_STATUS_SUCCESS) {
                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
                        sdata->dev->name, status_code);
-                list_del(&wk->list);
-                kfree(wk);
+                wk->state = IEEE80211_MGD_STATE_IDLE;
                 return RX_MGMT_CFG80211_ASSOC;
         }
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index db4bda681ec9..eaa4118de988 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1445,7 +1445,7 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                                 if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
                                         continue;
                                 if (compare_ether_addr(tmp_sdata->dev->dev_addr,
-                                                       hdr->addr2)) {
+                                                       hdr->addr2) == 0) {
                                         dev_hold(tmp_sdata->dev);
                                         dev_put(sdata->dev);
                                         sdata = tmp_sdata;