diff --git a/[refs] b/[refs]
index 36cbfb1c7d3d..42243c47936f 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 57ef5ddb456649667438e023f67dd3a3ff3fbed8
+refs/heads/master: 70bdb6b275d789ddf05c3a858e6b57715539394b
diff --git a/trunk/net/mac80211/mesh_plink.c b/trunk/net/mac80211/mesh_plink.c
index cb14253587f1..ffcbad75e09b 100644
--- a/trunk/net/mac80211/mesh_plink.c
+++ b/trunk/net/mac80211/mesh_plink.c
@@ -409,7 +409,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
 	baselen = (u8 *) mgmt->u.action.u.plink_action.variable - (u8 *) mgmt;
 	if (mgmt->u.action.u.plink_action.action_code == PLINK_CONFIRM) {
 		baseaddr += 4;
-		baselen -= 4;
+		baselen += 4;
 	}
 	ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
 	if (!elems.peer_link) {