7 files changed, 27 insertions, 13 deletions

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index e92f1fd28aa5..5df2f6a0b0f0 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1077,12 +1077,16 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                 ip_mc_up(in_dev);
                 /* fall through */
         case NETDEV_CHANGEADDR:
-                if (IN_DEV_ARP_NOTIFY(in_dev))
-                        arp_send(ARPOP_REQUEST, ETH_P_ARP,
-                                 in_dev->ifa_list->ifa_address,
-                                 dev,
-                                 in_dev->ifa_list->ifa_address,
-                                 NULL, dev->dev_addr, NULL);
+                /* Send gratuitous ARP to notify of link change */
+                if (IN_DEV_ARP_NOTIFY(in_dev)) {
+                        struct in_ifaddr *ifa = in_dev->ifa_list;
+
+                        if (ifa)
+                                arp_send(ARPOP_REQUEST, ETH_P_ARP,
+                                         ifa->ifa_address, dev,
+                                         ifa->ifa_address, NULL,
+                                         dev->dev_addr, NULL);
+                }
                 break;
         case NETDEV_DOWN:
                 ip_mc_down(in_dev);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c01588f9d453..865fbc09be1a 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2164,11 +2164,17 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 
         skb = rx.skb;
 
-        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+        if (rx.sdata && ieee80211_is_data(hdr->frame_control)) {
+                rx.flags |= IEEE80211_RX_RA_MATCH;
+                prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
+                if (prepares)
+                        prev = rx.sdata;
+        } else list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 if (!netif_running(sdata->dev))
                         continue;
 
-                if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                         continue;
 
                 rx.flags |= IEEE80211_RX_RA_MATCH;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index eec001491e66..594f2318c3d8 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -361,6 +361,7 @@ int sta_info_insert(struct sta_info *sta)
                                              u.ap);
 
                 drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD, &sta->sta);
+                sdata = sta->sdata;
         }
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
@@ -496,6 +497,7 @@ static void __sta_info_unlink(struct sta_info **sta)
 
                 drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
                                &(*sta)->sta);
+                sdata = (*sta)->sdata;
         }
 
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index fd4028296613..db4bda681ec9 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1704,7 +1704,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         if (!is_multicast_ether_addr(hdr.addr1)) {
                 rcu_read_lock();
                 sta = sta_info_get(local, hdr.addr1);
-                if (sta)
+                /* XXX: in the future, use sdata to look up the sta */
+                if (sta && sta->sdata == sdata)
                         sta_flags = get_sta_flags(sta);
                 rcu_read_unlock();
         }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index dd6564321369..aeb65b3d2295 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -339,7 +339,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         if (WARN_ON(!info->control.vif)) {
-                kfree(skb);
+                kfree_skb(skb);
                 return;
         }
 
@@ -367,7 +367,7 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
                 if (WARN_ON(!info->control.vif)) {
-                        kfree(skb);
+                        kfree_skb(skb);
                         continue;
                 }
 
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 6a536949cdc0..7cf6c0fbc7a6 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -350,7 +350,7 @@ static int tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp,
         tcm = NLMSG_DATA(nlh);
         tcm->tcm_family = AF_UNSPEC;
         tcm->tcm__pad1 = 0;
-        tcm->tcm__pad1 = 0;
+        tcm->tcm__pad2 = 0;
         tcm->tcm_ifindex = qdisc_dev(tp->q)->ifindex;
         tcm->tcm_parent = tp->classid;
         tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 14004e2ebd62..f48394126bf9 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4031,7 +4031,7 @@ static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
         rdev = cfg80211_get_dev_from_info(info);
         if (IS_ERR(rdev)) {
                 err = PTR_ERR(rdev);
-                goto out;
+                goto out_rtnl;
         }
 
         net = get_net_ns_by_pid(pid);
@@ -4051,6 +4051,7 @@ static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
         put_net(net);
  out:
         cfg80211_unlock_rdev(rdev);
+ out_rtnl:
         rtnl_unlock();
         return err;
 }