mac80211: use ieee80211_free_txskb in a few more places to prevent skb leaks
[openwrt.git] / package / mac80211 / patches / 300-pending_work.patch
index 371e82bcaeae36d334304055b6daf2319756b29d..f7a0aede533607339ff565ad19e405b1584ec924 100644 (file)
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -1122,6 +1122,7 @@ struct cfg80211_ibss_params {
-       u8 *ssid;
-       u8 *bssid;
-       struct ieee80211_channel *channel;
-+      enum nl80211_channel_type channel_type;
-       u8 *ie;
-       u8 ssid_len, ie_len;
-       u16 beacon_interval;
-@@ -3188,6 +3189,16 @@ void cfg80211_gtk_rekey_notify(struct ne
- void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
-                                    const u8 *bssid, bool preauth, gfp_t gfp);
-+/**
-+ * cfg80211_can_use_ext_chan - test if ht40 on extension channel can be used
-+ * @wiphy: the wiphy
-+ * @chan: main channel
-+ * @channel_type: HT mode
-+ */
-+bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
-+                                struct ieee80211_channel *chan,
-+                                enum nl80211_channel_type channel_type);
-+
- /* Logging, debugging and troubleshooting/diagnostic helpers. */
- /* wiphy_printk helpers, similar to dev_printk */
+--- a/drivers/net/wireless/ath/ath5k/base.c
++++ b/drivers/net/wireless/ath/ath5k/base.c
+@@ -325,6 +325,8 @@ ath5k_setup_channels(struct ath5k_hw *ah
+               if (!ath5k_is_standard_channel(ch, band))
+                       continue;
++              channels[count].max_power = AR5K_TUNE_MAX_TXPOWER/2;
++
+               count++;
+       }
 --- a/net/mac80211/agg-rx.c
 +++ b/net/mac80211/agg-rx.c
-@@ -180,6 +180,10 @@ static void ieee80211_send_addba_resp(st
-               memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
-       else if (sdata->vif.type == NL80211_IFTYPE_STATION)
+@@ -203,6 +203,8 @@ static void ieee80211_send_addba_resp(st
                memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+       else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
+               memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
 +      else if (sdata->vif.type == NL80211_IFTYPE_WDS)
 +              memcpy(mgmt->bssid, da, ETH_ALEN);
-+      else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-+              memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
  
        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                          IEEE80211_STYPE_ACTION);
 --- a/net/mac80211/agg-tx.c
 +++ b/net/mac80211/agg-tx.c
-@@ -77,10 +77,13 @@ static void ieee80211_send_addba_request
-       memcpy(mgmt->da, da, ETH_ALEN);
+@@ -81,7 +81,8 @@ static void ieee80211_send_addba_request
        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
        if (sdata->vif.type == NL80211_IFTYPE_AP ||
--          sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-+          sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+           sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+-          sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
++          sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
 +          sdata->vif.type == NL80211_IFTYPE_WDS)
                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
-+      else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-+              memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
-       mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                         IEEE80211_STYPE_ACTION);
-@@ -397,7 +400,9 @@ int ieee80211_start_tx_ba_session(struct
-        */
-       if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+@@ -460,6 +461,7 @@ int ieee80211_start_tx_ba_session(struct
+           sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
            sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
--          sdata->vif.type != NL80211_IFTYPE_AP)
-+          sdata->vif.type != NL80211_IFTYPE_AP &&
-+          sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-+          sdata->vif.type != NL80211_IFTYPE_WDS)
+           sdata->vif.type != NL80211_IFTYPE_AP &&
++          sdata->vif.type != NL80211_IFTYPE_WDS &&
+           sdata->vif.type != NL80211_IFTYPE_ADHOC)
                return -EINVAL;
  
-       if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
+@@ -869,7 +871,7 @@ void ieee80211_process_addba_resp(struct
+       } else {
+               ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR,
+-                                              true);
++                                              false);
+       }
+  out:
 --- a/net/mac80211/debugfs_sta.c
 +++ b/net/mac80211/debugfs_sta.c
 @@ -63,11 +63,11 @@ static ssize_t sta_flags_read(struct fil
        test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
  
        int res = scnprintf(buf, sizeof(buf),
--                          "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
-+                          "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
+-                          "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
++                          "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
                            TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
                            TEST(PS_DRIVER), TEST(AUTHORIZED),
-                           TEST(SHORT_PREAMBLE), TEST(ASSOC_AP),
+                           TEST(SHORT_PREAMBLE),
 -                          TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
 +                          TEST(WME), TEST(CLEAR_PS_FILT),
                            TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
                            TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
-                           TEST(TDLS_PEER_AUTH));
---- a/net/mac80211/ht.c
-+++ b/net/mac80211/ht.c
-@@ -199,6 +199,8 @@ void ieee80211_send_delba(struct ieee802
-               memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
-       else if (sdata->vif.type == NL80211_IFTYPE_STATION)
-               memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
-+      else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-+              memcpy(mgmt->bssid, sdata->u.ibss.bssid, ETH_ALEN);
-       mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                         IEEE80211_STYPE_ACTION);
---- a/net/mac80211/ibss.c
-+++ b/net/mac80211/ibss.c
-@@ -77,6 +77,7 @@ static void __ieee80211_sta_join_ibss(st
-       struct cfg80211_bss *bss;
-       u32 bss_change;
-       u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
-+      enum nl80211_channel_type channel_type;
-       lockdep_assert_held(&ifibss->mtx);
-@@ -104,8 +105,16 @@ static void __ieee80211_sta_join_ibss(st
-       sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
--      local->oper_channel = chan;
--      WARN_ON(!ieee80211_set_channel_type(local, sdata, NL80211_CHAN_NO_HT));
-+      channel_type = ifibss->channel_type;
-+      if (channel_type > NL80211_CHAN_HT20 &&
-+          !cfg80211_can_beacon_sec_chan(local->hw.wiphy, chan, channel_type))
-+              channel_type = NL80211_CHAN_HT20;
-+      if (!ieee80211_set_channel_type(local, sdata, channel_type)) {
-+              /* can only fail due to HT40+/- mismatch */
-+              channel_type = NL80211_CHAN_HT20;
-+              WARN_ON(!ieee80211_set_channel_type(local, sdata,
-+                                                  NL80211_CHAN_HT20));
-+      }
-       ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
-       sband = local->hw.wiphy->bands[chan->band];
-@@ -171,6 +180,18 @@ static void __ieee80211_sta_join_ibss(st
-               memcpy(skb_put(skb, ifibss->ie_len),
-                      ifibss->ie, ifibss->ie_len);
-+      /* add HT capability and information IEs */
-+      if (channel_type && sband->ht_cap.ht_supported) {
-+              pos = skb_put(skb, 4 +
-+                                 sizeof(struct ieee80211_ht_cap) +
-+                                 sizeof(struct ieee80211_ht_info));
-+              pos = ieee80211_ie_build_ht_cap(pos, sband, sband->ht_cap.cap);
-+              pos = ieee80211_ie_build_ht_info(pos,
-+                                               &sband->ht_cap,
-+                                               chan,
-+                                               channel_type);
-+      }
-+
-       if (local->hw.queues >= 4) {
-               pos = skb_put(skb, 9);
-               *pos++ = WLAN_EID_VENDOR_SPECIFIC;
-@@ -194,6 +215,7 @@ static void __ieee80211_sta_join_ibss(st
-       bss_change |= BSS_CHANGED_BEACON;
-       bss_change |= BSS_CHANGED_BEACON_ENABLED;
-       bss_change |= BSS_CHANGED_BASIC_RATES;
-+      bss_change |= BSS_CHANGED_HT;
-       bss_change |= BSS_CHANGED_IBSS;
-       sdata->vif.bss_conf.ibss_joined = true;
-       ieee80211_bss_info_change_notify(sdata, bss_change);
-@@ -266,6 +288,7 @@ static void ieee80211_rx_bss_info(struct
-       u64 beacon_timestamp, rx_timestamp;
-       u32 supp_rates = 0;
-       enum ieee80211_band band = rx_status->band;
-+      struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
-       if (elems->ds_params && elems->ds_params_len == 1)
-               freq = ieee80211_channel_to_frequency(elems->ds_params[0],
-@@ -275,7 +298,10 @@ static void ieee80211_rx_bss_info(struct
-       channel = ieee80211_get_channel(local->hw.wiphy, freq);
--      if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
-+      if (!channel ||
-+          channel->flags & (IEEE80211_CHAN_DISABLED ||
-+                            IEEE80211_CHAN_NO_IBSS ||
-+                            IEEE80211_CHAN_RADAR))
-               return;
-       if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
-@@ -313,8 +339,41 @@ static void ieee80211_rx_bss_info(struct
-                                               GFP_ATOMIC);
-               }
--              if (sta && elems->wmm_info)
--                      set_sta_flag(sta, WLAN_STA_WME);
-+              if (sta) {
-+                      if (elems->wmm_info)
-+                              set_sta_flag(sta, WLAN_STA_WME);
-+
-+                      /* we both use HT */
-+                      if (elems->ht_info_elem && elems->ht_cap_elem &&
-+                          sdata->u.ibss.channel_type) {
-+                              enum nl80211_channel_type channel_type =
-+                                      ieee80211_ht_info_to_channel_type(
-+                                                         elems->ht_info_elem);
-+                              struct ieee80211_sta_ht_cap sta_ht_cap_new;
-+
-+                              /*
-+                               * fall back to HT20 if we don't use or use
-+                               * the other extension channel
-+                               */
-+                              if (channel_type > NL80211_CHAN_HT20 &&
-+                                  channel_type != sdata->u.ibss.channel_type)
-+                                      channel_type = NL80211_CHAN_HT20;
-+
-+                              ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
-+                                              elems->ht_cap_elem,
-+                                              &sta_ht_cap_new);
-+                              if (memcmp(&sta->sta.ht_cap, &sta_ht_cap_new,
-+                                         sizeof(sta_ht_cap_new))) {
-+                                      memcpy(&sta->sta.ht_cap,
-+                                             &sta_ht_cap_new,
-+                                             sizeof(sta_ht_cap_new));
-+                                      rate_control_rate_update(local, sband,
-+                                                      sta,
-+                                                      IEEE80211_RC_HT_CHANGED,
-+                                                      channel_type);
-+                              }
-+                      }
-+              }
-               rcu_read_unlock();
-       }
-@@ -896,10 +955,15 @@ int ieee80211_ibss_join(struct ieee80211
-       struct sk_buff *skb;
-       skb = dev_alloc_skb(sdata->local->hw.extra_tx_headroom +
--                          36 /* bitrates */ +
--                          34 /* SSID */ +
--                          3  /* DS params */ +
--                          4  /* IBSS params */ +
-+                          sizeof(struct ieee80211_hdr_3addr) +
-+                          12 /* struct ieee80211_mgmt.u.beacon */ +
-+                          2 + IEEE80211_MAX_SSID_LEN /* max SSID */ +
-+                          2 + 8 /* max Supported Rates */ +
-+                          3 /* max DS params */ +
-+                          4 /* IBSS params */ +
-+                          2 + (IEEE80211_MAX_SUPP_RATES - 8) +
-+                          2 + sizeof(struct ieee80211_ht_cap) +
-+                          2 + sizeof(struct ieee80211_ht_info) +
-                           params->ie_len);
-       if (!skb)
-               return -ENOMEM;
-@@ -920,13 +984,15 @@ int ieee80211_ibss_join(struct ieee80211
-       sdata->vif.bss_conf.beacon_int = params->beacon_interval;
-       sdata->u.ibss.channel = params->channel;
-+      sdata->u.ibss.channel_type = params->channel_type;
-       sdata->u.ibss.fixed_channel = params->channel_fixed;
-       /* fix ourselves to that channel now already */
-       if (params->channel_fixed) {
-               sdata->local->oper_channel = params->channel;
--              WARN_ON(!ieee80211_set_channel_type(sdata->local, sdata,
--                                                  NL80211_CHAN_NO_HT));
-+              if (!ieee80211_set_channel_type(sdata->local, sdata,
-+                                             params->channel_type))
-+                      return -EINVAL;
-       }
-       if (params->ie) {
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -465,6 +465,7 @@ struct ieee80211_if_ibss {
-       u8 ssid_len, ie_len;
-       u8 *ie;
-       struct ieee80211_channel *channel;
-+      enum nl80211_channel_type channel_type;
-       unsigned long ibss_join_req;
-       /* probe response/beacon for IBSS */
-@@ -1339,6 +1340,12 @@ void ieee80211_recalc_smps(struct ieee80
- size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
-                         const u8 *ids, int n_ids, size_t offset);
- size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset);
-+u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_supported_band *sband,
-+                            u16 cap);
-+u8 *ieee80211_ie_build_ht_info(u8 *pos,
-+                              struct ieee80211_sta_ht_cap *ht_cap,
-+                              struct ieee80211_channel *channel,
-+                              enum nl80211_channel_type channel_type);
- /* internal work items */
- void ieee80211_work_init(struct ieee80211_local *local);
-@@ -1367,6 +1374,8 @@ ieee80211_get_channel_mode(struct ieee80
- bool ieee80211_set_channel_type(struct ieee80211_local *local,
-                               struct ieee80211_sub_if_data *sdata,
-                               enum nl80211_channel_type chantype);
-+enum nl80211_channel_type
-+ieee80211_ht_info_to_channel_type(struct ieee80211_ht_info *ht_info);
- #ifdef CONFIG_MAC80211_NOINLINE
- #define debug_noinline noinline
+                           TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -178,7 +178,6 @@ static int ieee80211_do_open(struct net_
- {
-       struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+@@ -420,7 +420,6 @@ int ieee80211_do_open(struct wireless_de
+       struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+       struct net_device *dev = wdev->netdev;
        struct ieee80211_local *local = sdata->local;
 -      struct sta_info *sta;
        u32 changed = 0;
        int res;
        u32 hw_reconf_flags = 0;
-@@ -290,27 +289,6 @@ static int ieee80211_do_open(struct net_
+@@ -575,30 +574,8 @@ int ieee80211_do_open(struct wireless_de
  
        set_bit(SDATA_STATE_RUNNING, &sdata->state);
  
 -                      goto err_del_interface;
 -              }
 -
--              /* no atomic bitop required since STA is not live yet */
--              set_sta_flag(sta, WLAN_STA_AUTHORIZED);
+-              sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
+-              sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
+-              sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 -
 -              res = sta_info_insert(sta);
 -              if (res) {
 -              }
 -
 -              rate_control_rate_init(sta);
+-              netif_carrier_on(dev);
+-      } else if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
++      if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
+               rcu_assign_pointer(local->p2p_sdata, sdata);
 -      }
--
        /*
         * set_multicast_list will be invoked by the networking core
-        * which will check whether any increments here were done in
-@@ -344,8 +322,7 @@ static int ieee80211_do_open(struct net_
-       netif_tx_start_all_queues(dev);
-       return 0;
-- err_del_interface:
--      drv_remove_interface(local, &sdata->vif);
-+
-  err_stop:
-       if (!local->open_count)
-               drv_stop(local);
-@@ -716,6 +693,70 @@ static void ieee80211_if_setup(struct ne
+@@ -997,6 +974,72 @@ static void ieee80211_if_setup(struct ne
        dev->destructor = free_netdev;
  }
  
 +      ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
 +                             skb->len - baselen, &elems);
 +
-+      rates = ieee80211_sta_get_rates(local, &elems, band);
++      rates = ieee80211_sta_get_rates(local, &elems, band, NULL);
 +
 +      rcu_read_lock();
 +
 +      sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
 +
 +      if (elems.ht_cap_elem)
-+              ieee80211_ht_cap_ie_to_sta_ht_cap(sband,
++              ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
 +                              elems.ht_cap_elem, &sta->sta.ht_cap);
 +
 +      if (elems.wmm_param)
 +              set_sta_flag(sta, WLAN_STA_WME);
 +
 +      if (new) {
-+              set_sta_flag(sta, WLAN_STA_AUTHORIZED);
++              sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
++              sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
++              sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 +              rate_control_rate_init(sta);
 +              sta_info_insert_rcu(sta);
 +      }
  static void ieee80211_iface_work(struct work_struct *work)
  {
        struct ieee80211_sub_if_data *sdata =
-@@ -820,6 +861,9 @@ static void ieee80211_iface_work(struct 
+@@ -1101,6 +1144,9 @@ static void ieee80211_iface_work(struct 
                                break;
                        ieee80211_mesh_rx_queued_mgmt(sdata, skb);
                        break;
                        break;
 --- a/net/mac80211/rx.c
 +++ b/net/mac80211/rx.c
-@@ -2211,7 +2211,9 @@ ieee80211_rx_h_action(struct ieee80211_r
-                */
-               if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+@@ -2279,6 +2279,7 @@ ieee80211_rx_h_action(struct ieee80211_r
+                   sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
                    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
--                  sdata->vif.type != NL80211_IFTYPE_AP)
-+                  sdata->vif.type != NL80211_IFTYPE_AP &&
-+                  sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-+                  sdata->vif.type != NL80211_IFTYPE_WDS)
+                   sdata->vif.type != NL80211_IFTYPE_AP &&
++                  sdata->vif.type != NL80211_IFTYPE_WDS &&
+                   sdata->vif.type != NL80211_IFTYPE_ADHOC)
                        break;
  
-               /* verify action_code is present */
-@@ -2426,13 +2428,14 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
+@@ -2496,14 +2497,15 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_
  
        if (!ieee80211_vif_is_mesh(&sdata->vif) &&
            sdata->vif.type != NL80211_IFTYPE_ADHOC &&
                return RX_DROP_MONITOR;
  
        switch (stype) {
+       case cpu_to_le16(IEEE80211_STYPE_AUTH):
        case cpu_to_le16(IEEE80211_STYPE_BEACON):
        case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
 -              /* process for all: mesh, mlme, ibss */
 +              /* process for all: mesh, mlme, ibss, wds */
                break;
-       case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
-       case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
-@@ -2775,10 +2778,16 @@ static int prepare_for_handlers(struct i
+       case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
+       case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
+@@ -2827,10 +2829,16 @@ static int prepare_for_handlers(struct i
                }
                break;
        case NL80211_IFTYPE_WDS:
 -              if (bssid || !ieee80211_is_data(hdr->frame_control))
 -                      return 0;
-               if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
+               if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
                        return 0;
 +
 +              if (ieee80211_is_data(hdr->frame_control) ||
 +                      return 0;
 +
                break;
-       default:
-               /* should never get here */
+       case NL80211_IFTYPE_P2P_DEVICE:
+               if (!ieee80211_is_public_action(hdr, skb->len) &&
 --- a/net/mac80211/sta_info.h
 +++ b/net/mac80211/sta_info.h
 @@ -32,7 +32,6 @@
+  * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
   *    frames.
-  * @WLAN_STA_ASSOC_AP: We're associated to that station, it is an AP.
   * @WLAN_STA_WME: Station is a QoS-STA.
 - * @WLAN_STA_WDS: Station is one of our WDS peers.
   * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
   *    IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
   *    frame to this station is transmitted.
-@@ -61,7 +60,6 @@ enum ieee80211_sta_info_flags {
+@@ -64,7 +63,6 @@ enum ieee80211_sta_info_flags {
+       WLAN_STA_AUTHORIZED,
        WLAN_STA_SHORT_PREAMBLE,
-       WLAN_STA_ASSOC_AP,
        WLAN_STA_WME,
 -      WLAN_STA_WDS,
        WLAN_STA_CLEAR_PS_FILT,
        WLAN_STA_MFP,
        WLAN_STA_BLOCK_BA,
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -836,23 +836,8 @@ int ieee80211_build_preq_ies(struct ieee
-               offset = noffset;
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -517,29 +517,41 @@ void ieee80211_tx_status(struct ieee8021
+       if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
+               u64 cookie = (unsigned long)skb;
++              bool found = false;
++
+               acked = info->flags & IEEE80211_TX_STAT_ACK;
+-              if (ieee80211_is_nullfunc(hdr->frame_control) ||
+-                  ieee80211_is_qos_nullfunc(hdr->frame_control)) {
+-                      cfg80211_probe_status(skb->dev, hdr->addr1,
+-                                            cookie, acked, GFP_ATOMIC);
+-              } else if (skb->dev) {
+-                      cfg80211_mgmt_tx_status(
+-                              skb->dev->ieee80211_ptr, cookie, skb->data,
+-                              skb->len, acked, GFP_ATOMIC);
+-              } else {
+-                      struct ieee80211_sub_if_data *p2p_sdata;
++              rcu_read_lock();
+-                      rcu_read_lock();
++              list_for_each_entry_rcu(sdata, &local->interfaces, list) {
++                      if (!sdata->dev)
++                              continue;
+-                      p2p_sdata = rcu_dereference(local->p2p_sdata);
+-                      if (p2p_sdata) {
+-                              cfg80211_mgmt_tx_status(
+-                                      &p2p_sdata->wdev, cookie, skb->data,
+-                                      skb->len, acked, GFP_ATOMIC);
+-                      }
+-                      rcu_read_unlock();
++                      if (skb->dev != sdata->dev)
++                              continue;
++
++                      found = true;
++                      break;
+               }
++
++              if (!skb->dev) {
++                      sdata = rcu_dereference(local->p2p_sdata);
++                      if (sdata)
++                              found = true;
++              }
++
++              if (!found)
++                      skb->dev = NULL;
++              else if (ieee80211_is_nullfunc(hdr->frame_control) ||
++                       ieee80211_is_qos_nullfunc(hdr->frame_control)) {
++                      cfg80211_probe_status(sdata->dev, hdr->addr1,
++                                            cookie, acked, GFP_ATOMIC);
++              } else {
++                      cfg80211_mgmt_tx_status(&sdata->wdev, cookie, skb->data,
++                                              skb->len, acked, GFP_ATOMIC);
++              }
++
++              rcu_read_unlock();
        }
  
--      if (sband->ht_cap.ht_supported) {
--              u16 cap = sband->ht_cap.cap;
--              __le16 tmp;
--
--              *pos++ = WLAN_EID_HT_CAPABILITY;
--              *pos++ = sizeof(struct ieee80211_ht_cap);
--              memset(pos, 0, sizeof(struct ieee80211_ht_cap));
--              tmp = cpu_to_le16(cap);
--              memcpy(pos, &tmp, sizeof(u16));
--              pos += sizeof(u16);
--              *pos++ = sband->ht_cap.ampdu_factor |
--                       (sband->ht_cap.ampdu_density <<
--                              IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
--              memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
--              pos += sizeof(sband->ht_cap.mcs);
--              pos += 2 + 4 + 1; /* ext info, BF cap, antsel */
--      }
-+      if (sband->ht_cap.ht_supported)
-+              pos = ieee80211_ie_build_ht_cap(pos, sband, sband->ht_cap.cap);
+       if (unlikely(info->ack_frame_id)) {
+--- a/drivers/net/wireless/p54/main.c
++++ b/drivers/net/wireless/p54/main.c
+@@ -139,6 +139,7 @@ static int p54_beacon_format_ie_tim(stru
+ static int p54_beacon_update(struct p54_common *priv,
+                       struct ieee80211_vif *vif)
+ {
++      struct ieee80211_tx_control control = { };
+       struct sk_buff *beacon;
+       int ret;
  
-       /*
-        * If adding more here, adjust code in main.c
-@@ -1443,3 +1428,100 @@ int ieee80211_add_ext_srates_ie(struct i
+@@ -158,7 +159,7 @@ static int p54_beacon_update(struct p54_
+        * to cancel the old beacon template by hand, instead the firmware
+        * will release the previous one through the feedback mechanism.
+        */
+-      p54_tx_80211(priv->hw, NULL, beacon);
++      p54_tx_80211(priv->hw, &control, beacon);
+       priv->tsf_high32 = 0;
+       priv->tsf_low32 = 0;
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -352,6 +352,9 @@ static void reg_regdb_search(struct work
+       struct reg_regdb_search_request *request;
+       const struct ieee80211_regdomain *curdom, *regdom;
+       int i, r;
++      bool set_reg = false;
++
++      mutex_lock(&cfg80211_mutex);
+       mutex_lock(&reg_regdb_search_mutex);
+       while (!list_empty(&reg_regdb_search_list)) {
+@@ -367,9 +370,7 @@ static void reg_regdb_search(struct work
+                               r = reg_copy_regd(&regdom, curdom);
+                               if (r)
+                                       break;
+-                              mutex_lock(&cfg80211_mutex);
+-                              set_regdom(regdom);
+-                              mutex_unlock(&cfg80211_mutex);
++                              set_reg = true;
+                               break;
+                       }
+               }
+@@ -377,6 +378,11 @@ static void reg_regdb_search(struct work
+               kfree(request);
        }
-       return 0;
- }
-+
-+u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_supported_band *sband,
-+                            u16 cap)
-+{
-+      __le16 tmp;
+       mutex_unlock(&reg_regdb_search_mutex);
 +
-+      *pos++ = WLAN_EID_HT_CAPABILITY;
-+      *pos++ = sizeof(struct ieee80211_ht_cap);
-+      memset(pos, 0, sizeof(struct ieee80211_ht_cap));
++      if (set_reg)
++              set_regdom(regdom);
 +
-+      /* capability flags */
-+      tmp = cpu_to_le16(cap);
-+      memcpy(pos, &tmp, sizeof(u16));
-+      pos += sizeof(u16);
-+
-+      /* AMPDU parameters */
-+      *pos++ = sband->ht_cap.ampdu_factor |
-+               (sband->ht_cap.ampdu_density <<
-+                      IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
-+
-+      /* MCS set */
-+      memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
-+      pos += sizeof(sband->ht_cap.mcs);
-+
-+      /* extended capabilities */
-+      pos += sizeof(__le16);
++      mutex_unlock(&cfg80211_mutex);
+ }
+ static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
+--- a/drivers/net/wireless/ath/ath9k/recv.c
++++ b/drivers/net/wireless/ath/ath9k/recv.c
+@@ -424,8 +424,8 @@ u32 ath_calcrxfilter(struct ath_softc *s
+               rfilt |= ATH9K_RX_FILTER_COMP_BAR;
+       if (sc->nvifs > 1 || (sc->rx.rxfilter & FIF_OTHER_BSS)) {
+-              /* The following may also be needed for other older chips */
+-              if (sc->sc_ah->hw_version.macVersion == AR_SREV_VERSION_9160)
++              /* This is needed for older chips */
++              if (sc->sc_ah->hw_version.macVersion <= AR_SREV_VERSION_9160)
+                       rfilt |= ATH9K_RX_FILTER_PROM;
+               rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
+       }
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -818,23 +818,71 @@ void ieee80211_sta_process_chanswitch(st
+ }
+ static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
+-                                      u16 capab_info, u8 *pwr_constr_elem,
+-                                      u8 pwr_constr_elem_len)
++                                      struct ieee80211_channel *channel,
++                                      const u8 *country_ie, u8 country_ie_len,
++                                      const u8 *pwr_constr_elem)
+ {
+-      struct ieee80211_conf *conf = &sdata->local->hw.conf;
++      struct ieee80211_country_ie_triplet *triplet;
++      int chan = ieee80211_frequency_to_channel(channel->center_freq);
++      int i, chan_pwr, chan_increment, new_ap_level;
++      bool have_chan_pwr = false;
+-      if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT))
++      /* Invalid IE */
++      if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
+               return;
+-      /* Power constraint IE length should be 1 octet */
+-      if (pwr_constr_elem_len != 1)
+-              return;
++      triplet = (void *)(country_ie + 3);
++      country_ie_len -= 3;
+-      if ((*pwr_constr_elem <= conf->channel->max_reg_power) &&
+-          (*pwr_constr_elem != sdata->local->power_constr_level)) {
+-              sdata->local->power_constr_level = *pwr_constr_elem;
+-              ieee80211_hw_config(sdata->local, 0);
++      switch (channel->band) {
++      default:
++              WARN_ON_ONCE(1);
++              /* fall through */
++      case IEEE80211_BAND_2GHZ:
++      case IEEE80211_BAND_60GHZ:
++              chan_increment = 1;
++              break;
++      case IEEE80211_BAND_5GHZ:
++              chan_increment = 4;
++              break;
+       }
 +
-+      /* BF capabilities */
-+      pos += sizeof(__le32);
++      /* find channel */
++      while (country_ie_len >= 3) {
++              u8 first_channel = triplet->chans.first_channel;
 +
-+      /* antenna selection */
-+      pos += sizeof(u8);
++              if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
++                      goto next;
 +
-+      return pos;
-+}
++              for (i = 0; i < triplet->chans.num_channels; i++) {
++                      if (first_channel + i * chan_increment == chan) {
++                              have_chan_pwr = true;
++                              chan_pwr = triplet->chans.max_power;
++                              break;
++                      }
++              }
++              if (have_chan_pwr)
++                      break;
 +
-+u8 *ieee80211_ie_build_ht_info(u8 *pos,
-+                             struct ieee80211_sta_ht_cap *ht_cap,
-+                             struct ieee80211_channel *channel,
-+                             enum nl80211_channel_type channel_type)
-+{
-+      struct ieee80211_ht_info *ht_info;
-+      /* Build HT Information */
-+      *pos++ = WLAN_EID_HT_INFORMATION;
-+      *pos++ = sizeof(struct ieee80211_ht_info);
-+      ht_info = (struct ieee80211_ht_info *)pos;
-+      ht_info->control_chan =
-+                      ieee80211_frequency_to_channel(channel->center_freq);
-+      switch (channel_type) {
-+      case NL80211_CHAN_HT40MINUS:
-+              ht_info->ht_param = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
-+              break;
-+      case NL80211_CHAN_HT40PLUS:
-+              ht_info->ht_param = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
-+              break;
-+      case NL80211_CHAN_HT20:
-+      default:
-+              ht_info->ht_param = IEEE80211_HT_PARAM_CHA_SEC_NONE;
-+              break;
++ next:
++              triplet++;
++              country_ie_len -= 3;
 +      }
-+      if (ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
-+              ht_info->ht_param |= IEEE80211_HT_PARAM_CHAN_WIDTH_ANY;
-+      ht_info->operation_mode = 0x0000;
-+      ht_info->stbc_param = 0x0000;
-+
-+      /* It seems that Basic MCS set and Supported MCS set
-+         are identical for the first 10 bytes */
-+      memset(&ht_info->basic_set, 0, 16);
-+      memcpy(&ht_info->basic_set, &ht_cap->mcs, 10);
 +
-+      return pos + sizeof(struct ieee80211_ht_info);
-+}
-+
-+enum nl80211_channel_type
-+ieee80211_ht_info_to_channel_type(struct ieee80211_ht_info *ht_info)
-+{
-+      enum nl80211_channel_type channel_type;
++      if (!have_chan_pwr)
++              return;
 +
-+      if (!ht_info)
-+              return NL80211_CHAN_NO_HT;
++      new_ap_level = max_t(int, 0, chan_pwr - *pwr_constr_elem);
 +
-+      switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-+      case IEEE80211_HT_PARAM_CHA_SEC_NONE:
-+              channel_type = NL80211_CHAN_HT20;
-+              break;
-+      case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-+              channel_type = NL80211_CHAN_HT40PLUS;
-+              break;
-+      case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-+              channel_type = NL80211_CHAN_HT40MINUS;
-+              break;
-+      default:
-+              channel_type = NL80211_CHAN_NO_HT;
-+      }
++      if (sdata->local->ap_power_level == new_ap_level)
++              return;
 +
-+      return channel_type;
-+}
---- a/net/mac80211/work.c
-+++ b/net/mac80211/work.c
-@@ -118,7 +118,6 @@ static void ieee80211_add_ht_ie(struct s
-       u8 *pos;
-       u32 flags = channel->flags;
-       u16 cap = sband->ht_cap.cap;
--      __le16 tmp;
-       if (!sband->ht_cap.ht_supported)
-               return;
-@@ -169,34 +168,8 @@ static void ieee80211_add_ht_ie(struct s
-       }
-       /* reserve and fill IE */
--
-       pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
--      *pos++ = WLAN_EID_HT_CAPABILITY;
--      *pos++ = sizeof(struct ieee80211_ht_cap);
--      memset(pos, 0, sizeof(struct ieee80211_ht_cap));
--
--      /* capability flags */
--      tmp = cpu_to_le16(cap);
--      memcpy(pos, &tmp, sizeof(u16));
--      pos += sizeof(u16);
--
--      /* AMPDU parameters */
--      *pos++ = sband->ht_cap.ampdu_factor |
--               (sband->ht_cap.ampdu_density <<
--                      IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
--
--      /* MCS set */
--      memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
--      pos += sizeof(sband->ht_cap.mcs);
--
--      /* extended capabilities */
--      pos += sizeof(__le16);
--
--      /* BF capabilities */
--      pos += sizeof(__le32);
--
--      /* antenna selection */
--      pos += sizeof(u8);
-+      ieee80211_ie_build_ht_cap(pos, sband, cap);
++      sdata_info(sdata,
++                 "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
++                 new_ap_level, chan_pwr, *pwr_constr_elem,
++                 sdata->u.mgd.bssid);
++      sdata->local->ap_power_level = new_ap_level;
++      ieee80211_hw_config(sdata->local, 0);
  }
  
- static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
---- a/net/wireless/chan.c
-+++ b/net/wireless/chan.c
-@@ -44,9 +44,9 @@ rdev_freq_to_chan(struct cfg80211_regist
-       return chan;
- }
--static bool can_beacon_sec_chan(struct wiphy *wiphy,
--                              struct ieee80211_channel *chan,
--                              enum nl80211_channel_type channel_type)
-+bool cfg80211_can_beacon_sec_chan(struct wiphy *wiphy,
-+                                struct ieee80211_channel *chan,
-+                                enum nl80211_channel_type channel_type)
- {
-       struct ieee80211_channel *sec_chan;
-       int diff;
-@@ -75,6 +75,7 @@ static bool can_beacon_sec_chan(struct w
-       return true;
- }
-+EXPORT_SYMBOL(cfg80211_can_beacon_sec_chan);
- int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
-                     struct wireless_dev *wdev, int freq,
-@@ -109,8 +110,8 @@ int cfg80211_set_freq(struct cfg80211_re
-               switch (channel_type) {
-               case NL80211_CHAN_HT40PLUS:
-               case NL80211_CHAN_HT40MINUS:
--                      if (!can_beacon_sec_chan(&rdev->wiphy, chan,
--                                               channel_type)) {
-+                      if (!cfg80211_can_beacon_sec_chan(&rdev->wiphy, chan,
-+                                                        channel_type)) {
-                               printk(KERN_DEBUG
-                                      "cfg80211: Secondary channel not "
-                                      "allowed to initiate communication\n");
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -4574,13 +4574,34 @@ static int nl80211_join_ibss(struct sk_b
-               ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+ void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif)
+@@ -1390,7 +1438,7 @@ static void ieee80211_set_disassoc(struc
+       sta = sta_info_get(sdata, ifmgd->bssid);
+       if (sta) {
+               set_sta_flag(sta, WLAN_STA_BLOCK_BA);
+-              ieee80211_sta_tear_down_BA_sessions(sta, tx);
++              ieee80211_sta_tear_down_BA_sessions(sta, false);
        }
+       mutex_unlock(&local->sta_mtx);
  
--      ibss.channel = ieee80211_get_channel(wiphy,
--              nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
-+      if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
-+              enum nl80211_channel_type channel_type;
-+
-+              channel_type = nla_get_u32(
-+                              info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
-+              if (channel_type > NL80211_CHAN_HT40PLUS)
-+                      return -EINVAL;
-+              ibss.channel_type = channel_type;
-+      } else {
-+              ibss.channel_type = NL80211_CHAN_NO_HT;
-+      }
-+
-+      ibss.channel = rdev_freq_to_chan(rdev,
-+              nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
-+              ibss.channel_type);
-       if (!ibss.channel ||
-+          ibss.channel->flags & IEEE80211_CHAN_RADAR ||
-           ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
-           ibss.channel->flags & IEEE80211_CHAN_DISABLED)
-               return -EINVAL;
+@@ -1438,7 +1486,7 @@ static void ieee80211_set_disassoc(struc
+       memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
+       memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
  
-+      /* Both channels should be able to initiate communication */
-+      if ((ibss.channel_type == NL80211_CHAN_HT40PLUS ||
-+           ibss.channel_type == NL80211_CHAN_HT40MINUS) &&
-+          !cfg80211_can_beacon_sec_chan(&rdev->wiphy, ibss.channel,
-+                                        ibss.channel_type))
-+              return -EINVAL;
-+
-       ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
-       ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
+-      local->power_constr_level = 0;
++      local->ap_power_level = 0;
+       del_timer_sync(&local->dynamic_ps_timer);
+       cancel_work_sync(&local->dynamic_ps_enable_work);
+@@ -2530,15 +2578,13 @@ static void ieee80211_rx_mgmt_beacon(str
+                                                 bssid, true);
+       }
  
+-      /* Note: country IE parsing is done for us by cfg80211 */
+-      if (elems.country_elem) {
+-              /* TODO: IBSS also needs this */
+-              if (elems.pwr_constr_elem)
+-                      ieee80211_handle_pwr_constr(sdata,
+-                              le16_to_cpu(mgmt->u.probe_resp.capab_info),
+-                              elems.pwr_constr_elem,
+-                              elems.pwr_constr_elem_len);
+-      }
++      if (elems.country_elem && elems.pwr_constr_elem &&
++          mgmt->u.probe_resp.capab_info &
++                              cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT))
++              ieee80211_handle_pwr_constr(sdata, local->oper_channel,
++                                          elems.country_elem,
++                                          elems.country_elem_len,
++                                          elems.pwr_constr_elem);
+       ieee80211_bss_info_change_notify(sdata, changed);
+ }
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -674,7 +674,7 @@ int __must_check __sta_info_destroy(stru
+        * will be sufficient.
+        */
+       set_sta_flag(sta, WLAN_STA_BLOCK_BA);
+-      ieee80211_sta_tear_down_BA_sessions(sta, true);
++      ieee80211_sta_tear_down_BA_sessions(sta, false);
+       ret = sta_info_hash_del(local, sta);
+       if (ret)
+--- a/drivers/net/wireless/ath/ath5k/phy.c
++++ b/drivers/net/wireless/ath/ath5k/phy.c
+@@ -1977,11 +1977,13 @@ ath5k_hw_set_spur_mitigation_filter(stru
+                       spur_delta_phase = (spur_offset << 18) / 25;
+                       spur_freq_sigma_delta = (spur_delta_phase >> 10);
+                       symbol_width = AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz / 2;
++                      break;
+               case AR5K_BWMODE_5MHZ:
+                       /* Both sample_freq and chip_freq are 10MHz (?) */
+                       spur_delta_phase = (spur_offset << 19) / 25;
+                       spur_freq_sigma_delta = (spur_delta_phase >> 10);
+                       symbol_width = AR5K_SPUR_SYMBOL_WIDTH_BASE_100Hz / 4;
++                      break;
+               default:
+                       if (channel->band == IEEE80211_BAND_5GHZ) {
+                               /* Both sample_freq and chip_freq are 40MHz */
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1062,7 +1062,7 @@ struct ieee80211_local {
+       bool disable_dynamic_ps;
+       int user_power_level; /* in dBm */
+-      int power_constr_level; /* in dBm */
++      int ap_power_level; /* in dBm */
+       enum ieee80211_smps_mode smps_mode;
+@@ -1170,7 +1170,6 @@ struct ieee802_11_elems {
+       u8 prep_len;
+       u8 perr_len;
+       u8 country_elem_len;
+-      u8 pwr_constr_elem_len;
+       u8 quiet_elem_len;
+       u8 num_of_quiet_elem;   /* can be more the one */
+       u8 timeout_int_len;
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -792,8 +792,11 @@ u32 ieee802_11_parse_elems_crc(u8 *start
+                       elems->country_elem_len = elen;
+                       break;
+               case WLAN_EID_PWR_CONSTRAINT:
++                      if (elen != 1) {
++                              elem_parse_failed = true;
++                              break;
++                      }
+                       elems->pwr_constr_elem = pos;
+-                      elems->pwr_constr_elem_len = elen;
+                       break;
+               case WLAN_EID_TIMEOUT_INTERVAL:
+                       elems->timeout_int = pos;
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -154,13 +154,11 @@ int ieee80211_hw_config(struct ieee80211
+       if (test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+           test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning) ||
+-          test_bit(SCAN_HW_SCANNING, &local->scanning))
++          test_bit(SCAN_HW_SCANNING, &local->scanning) ||
++          !local->ap_power_level)
+               power = chan->max_power;
+       else
+-              power = local->power_constr_level ?
+-                      min(chan->max_power,
+-                              (chan->max_reg_power  - local->power_constr_level)) :
+-                      chan->max_power;
++              power = min(chan->max_power, local->ap_power_level);
+       if (local->user_power_level >= 0)
+               power = min(power, local->user_power_level);