From d849fa8b9e85ffabd65d1ad346e8e98c2946b29c Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes@sipsolutions.net>
Date: Fri, 10 Jul 2009 11:39:26 +0200
Subject: [PATCH] --- yaml --- r: 159085 b: refs/heads/master c:
 a43816df2a1a61effcb701037bdf63621d066182 h: refs/heads/master i:   159083:
 5b114c0fcd4b6145f0103f7cb8d2c1ca1718b559 v: v3

---
 [refs]                         | 2 +-
 trunk/net/mac80211/mesh.c      | 5 ++++-
 trunk/net/mac80211/mesh_hwmp.c | 6 +++---
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/[refs] b/[refs]
index 598f257d638a..3304dfbd5750 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: ec3f149017ef3fd21343b1dcec3589eec6ba5dd5
+refs/heads/master: a43816df2a1a61effcb701037bdf63621d066182
diff --git a/trunk/net/mac80211/mesh.c b/trunk/net/mac80211/mesh.c
index 542ea025494e..8a97b1423088 100644
--- a/trunk/net/mac80211/mesh.c
+++ b/trunk/net/mac80211/mesh.c
@@ -685,9 +685,12 @@ ieee80211_mesh_rx_mgmt(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
 	fc = le16_to_cpu(mgmt->frame_control);
 
 	switch (fc & IEEE80211_FCTL_STYPE) {
+	case IEEE80211_STYPE_ACTION:
+		if (skb->len < IEEE80211_MIN_ACTION_SIZE)
+			return RX_DROP_MONITOR;
+		/* fall through */
 	case IEEE80211_STYPE_PROBE_RESP:
 	case IEEE80211_STYPE_BEACON:
-	case IEEE80211_STYPE_ACTION:
 		skb_queue_tail(&ifmsh->skb_queue, skb);
 		queue_work(local->hw.workqueue, &ifmsh->work);
 		return RX_QUEUED;
diff --git a/trunk/net/mac80211/mesh_hwmp.c b/trunk/net/mac80211/mesh_hwmp.c
index f49ef288e2e2..8e86e910edfc 100644
--- a/trunk/net/mac80211/mesh_hwmp.c
+++ b/trunk/net/mac80211/mesh_hwmp.c
@@ -686,11 +686,11 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
 	u8 ttl, dst_flags;
 	u32 lifetime;
 
-	spin_lock(&ifmsh->mesh_preq_queue_lock);
+	spin_lock_bh(&ifmsh->mesh_preq_queue_lock);
 	if (!ifmsh->preq_queue_len ||
 		time_before(jiffies, ifmsh->last_preq +
 				min_preq_int_jiff(sdata))) {
-		spin_unlock(&ifmsh->mesh_preq_queue_lock);
+		spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
 		return;
 	}
 
@@ -698,7 +698,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
 			struct mesh_preq_queue, list);
 	list_del(&preq_node->list);
 	--ifmsh->preq_queue_len;
-	spin_unlock(&ifmsh->mesh_preq_queue_lock);
+	spin_unlock_bh(&ifmsh->mesh_preq_queue_lock);
 
 	rcu_read_lock();
 	mpath = mesh_path_lookup(preq_node->dst, sdata);