2 files changed, 17 insertions, 2 deletions

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 4c3d1f591bec..ea10a51babda 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -389,6 +389,7 @@ struct ieee80211_if_managed {
 
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
+        bool broken_ap; /* AP is broken -- turn off powersave */
         enum ieee80211_smps_mode req_smps, /* requested smps mode */
                                  ap_smps, /* smps mode AP thinks we're in */
                                  driver_smps_mode; /* smps mode request */
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index ba2da11a997b..17258feaab9b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -637,6 +637,9 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
         if (!mgd->powersave)
                 return false;
 
+        if (mgd->broken_ap)
+                return false;
+
         if (!mgd->associated)
                 return false;
 
@@ -1489,10 +1492,21 @@ static bool ieee80211_assoc_success(struct ieee80211_work *wk,
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
 
         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
-                printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
-                       "set\n", sdata->name, aid);
+                printk(KERN_DEBUG
+                       "%s: invalid AID value 0x%x; bits 15:14 not set\n",
+                       sdata->name, aid);
         aid &= ~(BIT(15) | BIT(14));
 
+        ifmgd->broken_ap = false;
+
+        if (aid == 0 || aid > IEEE80211_MAX_AID) {
+                printk(KERN_DEBUG
+                       "%s: invalid AID value %d (out of range), turn off PS\n",
+                       sdata->name, aid);
+                aid = 0;
+                ifmgd->broken_ap = true;
+        }
+
         pos = mgmt->u.assoc_resp.variable;
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);