6 files changed, 38 insertions, 14 deletions

diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index ba2643a43c73..7836ee928983 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -83,6 +83,7 @@ endmenu
 config MAC80211_MESH
         bool "Enable mac80211 mesh networking (pre-802.11s) support"
         depends on MAC80211 && EXPERIMENTAL
+        depends on BROKEN
         ---help---
          This options enables support of Draft 802.11s mesh networking.
          The implementation is based on Draft 1.08 of the Mesh Networking
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 3c72557df45a..479597e88583 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -175,6 +175,8 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
+        might_sleep();
+
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
@@ -265,6 +267,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
+        might_sleep();
 
         if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
@@ -491,8 +494,10 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
  * @skb: frame to discard
  * @sdata: network subif the frame was to be sent through
  *
- * If the frame was beign forwarded from another MP, a PERR frame will be sent
- * to the precursor.
+ * If the frame was being forwarded from another MP, a PERR frame will be sent
+ * to the precursor.  The precursor's address (i.e. the previous hop) was saved
+ * in addr1 of the frame-to-be-forwarded, and would only be overwritten once
+ * the destination is successfully resolved.
  *
  * Locking: the function must me called within a rcu_read_lock region
  */
@@ -507,7 +512,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
                 u8 *ra, *da;
 
                 da = hdr->addr3;
-                ra = hdr->addr2;
+                ra = hdr->addr1;
                 mpath = mesh_path_lookup(da, sdata);
                 if (mpath)
                         dsn = ++mpath->dsn;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index aca22b00b6a3..07e7e41816be 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -721,7 +721,7 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
 {
         struct ieee80211_local *local = (void *) data;
 
-        if (local->quiescing)
+        if (local->quiescing || local->suspended)
                 return;
 
         queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7a549f9deb96..5e3d476972f9 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -55,15 +55,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
 
         rcu_read_unlock();
 
-        /* flush again, in case driver queued work */
-        flush_workqueue(local->hw.workqueue);
-
-        /* stop hardware - this must stop RX */
-        if (local->open_count) {
-                ieee80211_led_radio(local, false);
-                drv_stop(local);
-        }
-
         /* remove STAs */
         spin_lock_irqsave(&local->sta_lock, flags);
         list_for_each_entry(sta, &local->sta_list, list) {
@@ -111,7 +102,22 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                 drv_remove_interface(local, &conf);
         }
 
+        /* stop hardware - this must stop RX */
+        if (local->open_count) {
+                ieee80211_led_radio(local, false);
+                drv_stop(local);
+        }
+
+        /*
+         * flush again, in case driver queued work -- it
+         * shouldn't be doing (or cancel everything in the
+         * stop callback) that but better safe than sorry.
+         */
+        flush_workqueue(local->hw.workqueue);
+
         local->suspended = true;
+        /* need suspended to be visible before quiescing is false */
+        barrier();
         local->quiescing = false;
 
         return 0;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index de5bba7f910a..0936fc24942d 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2453,6 +2453,18 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                 return;
         }
 
+        /*
+         * If we're suspending, it is possible although not too likely
+         * that we'd be receiving frames after having already partially
+         * quiesced the stack. We can't process such frames then since
+         * that might, for example, cause stations to be added or other
+         * driver callbacks be invoked.
+         */
+        if (unlikely(local->quiescing || local->suspended)) {
+                kfree_skb(skb);
+                return;
+        }
+
         if (status->flag & RX_FLAG_HT) {
                 /* rate_idx is MCS index */
                 if (WARN_ON(status->rate_idx < 0 ||
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d238a8939a09..3a8922cd1038 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1455,7 +1455,7 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 monitor_iface = UNKNOWN_ADDRESS;
 
                 len_rthdr = ieee80211_get_radiotap_len(skb->data);
-                hdr = (struct ieee80211_hdr *)skb->data + len_rthdr;
+                hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
                 hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
                 /* check the header is complete in the frame */