7 files changed, 19 insertions, 52 deletions

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c3f3e431a573..2f0642d9e154 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1221,8 +1221,6 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sched_scan_stopped_work(struct work_struct *work);
 
 /* off-channel helpers */
-void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
-                                        bool tell_ap);
 void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
                                     bool offchannel_ps_enable);
 void ieee80211_offchannel_return(struct ieee80211_local *local,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 57989a046fca..ecb4c84c1bb3 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1385,9 +1385,11 @@ void ieee80211_beacon_connection_loss_work(struct work_struct *work)
         struct sta_info *sta;
 
         if (ifmgd->associated) {
+                rcu_read_lock();
                 sta = sta_info_get(sdata, ifmgd->bssid);
                 if (sta)
                         sta->beacon_loss_count++;
+                rcu_read_unlock();
         }
 
         if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index e4330d843575..f054e94901a2 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -138,23 +138,6 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
         mutex_unlock(&local->iflist_mtx);
 }
 
-void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
-                                        bool tell_ap)
-{
-        struct ieee80211_sub_if_data *sdata;
-
-        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata))
-                        continue;
-
-                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    sdata->u.mgd.associated)
-                        ieee80211_offchannel_ps_enable(sdata, tell_ap);
-        }
-        mutex_unlock(&local->iflist_mtx);
-}
-
 void ieee80211_offchannel_return(struct ieee80211_local *local,
                                  bool offchannel_ps_disable)
 {
@@ -162,6 +145,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                        clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
+
                 if (!ieee80211_sdata_running(sdata))
                         continue;
 
@@ -173,7 +159,6 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                 }
 
                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
-                        clear_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
                         /*
                          * This may wake up queues even though the driver
                          * currently has them stopped. This is not very
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 59f124c58333..f407427c642f 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1576,25 +1576,6 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 }
 
-static ieee80211_rx_result debug_noinline
-ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
-{
-        u8 *data = rx->skb->data;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
-
-        if (!ieee80211_is_data_qos(hdr->frame_control))
-                return RX_CONTINUE;
-
-        /* remove the qos control field, update frame type and meta-data */
-        memmove(data + IEEE80211_QOS_CTL_LEN, data,
-                ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
-        hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
-        /* change frame type to non QOS */
-        hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
-
-        return RX_CONTINUE;
-}
-
 static int
 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
 {
@@ -2718,7 +2699,6 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
                 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
                         CALL_RXH(ieee80211_rx_h_mesh_fwding);
 #endif
-                CALL_RXH(ieee80211_rx_h_remove_qos_control)
                 CALL_RXH(ieee80211_rx_h_amsdu)
                 CALL_RXH(ieee80211_rx_h_data)
                 CALL_RXH(ieee80211_rx_h_ctrl);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 2c9b493af249..9270771702fe 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -625,7 +625,7 @@ static void ieee80211_scan_state_resume(struct ieee80211_local *local,
         local->leave_oper_channel_time = jiffies;
 
         /* advance to the next channel to be scanned */
-        local->next_scan_state = SCAN_DECISION;
+        local->next_scan_state = SCAN_SET_CHANNEL;
 }
 
 void ieee80211_scan_work(struct work_struct *work)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index f0d3b483dabd..b197136aea2c 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -945,7 +945,8 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
         struct sta_info *sta, *tmp;
 
         mutex_lock(&local->sta_mtx);
-        list_for_each_entry_safe(sta, tmp, &local->sta_list, list)
+
+        list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
                 if (sdata != sta->sdata)
                         continue;
 
@@ -956,6 +957,8 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
 #endif
                         WARN_ON(__sta_info_destroy(sta));
                 }
+        }
+
         mutex_unlock(&local->sta_mtx);
 }
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index eb1a5f737a9c..9919892575f4 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1142,16 +1142,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                  */
         }
 #endif
-
-        /* setup fragmentation threshold */
-        drv_set_frag_threshold(local, hw->wiphy->frag_threshold);
-
-        /* setup RTS threshold */
-        drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
-
-        /* reset coverage class */
-        drv_set_coverage_class(local, hw->wiphy->coverage_class);
-
         /* everything else happens only if HW was up & running */
         if (!local->open_count)
                 goto wake_up;
@@ -1170,6 +1160,15 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 return res;
         }
 
+        /* setup fragmentation threshold */
+        drv_set_frag_threshold(local, hw->wiphy->frag_threshold);
+
+        /* setup RTS threshold */
+        drv_set_rts_threshold(local, hw->wiphy->rts_threshold);
+
+        /* reset coverage class */
+        drv_set_coverage_class(local, hw->wiphy->coverage_class);
+
         ieee80211_led_radio(local, true);
         ieee80211_mod_tpt_led_trig(local,
                                    IEEE80211_TPT_LEDTRIG_FL_RADIO, 0);