--- /dev/null
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 4 Sep 2016 17:46:24 +0200
+Subject: [PATCH] mac80211: fix sequence number assignment for PS response
+ frames
+
+When using intermediate queues, sequence number allocation is deferred
+until dequeue. This doesn't work for PS response frames, which bypass
+those queues.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -792,6 +792,36 @@ static __le16 ieee80211_tx_next_seq(stru
+ return ret;
+ }
+
++static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local,
++ struct ieee80211_vif *vif,
++ struct ieee80211_sta *pubsta,
++ struct sk_buff *skb)
++{
++ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
++ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++ struct ieee80211_txq *txq = NULL;
++
++ if ((info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) ||
++ (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE))
++ return NULL;
++
++ if (!ieee80211_is_data(hdr->frame_control))
++ return NULL;
++
++ if (pubsta) {
++ u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
++
++ txq = pubsta->txq[tid];
++ } else if (vif) {
++ txq = vif->txq;
++ }
++
++ if (!txq)
++ return NULL;
++
++ return to_txq_info(txq);
++}
++
+ static ieee80211_tx_result debug_noinline
+ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
+ {
+@@ -849,7 +879,8 @@ ieee80211_tx_h_sequence(struct ieee80211
+ tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
+ tx->sta->tx_stats.msdu[tid]++;
+
+- if (!tx->sta->sta.txq[0])
++ if (!ieee80211_get_txq(tx->local, info->control.vif, &tx->sta->sta,
++ tx->skb))
+ hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);
+
+ return TX_CONTINUE;
+@@ -1238,36 +1269,6 @@ ieee80211_tx_prepare(struct ieee80211_su
+ return TX_CONTINUE;
+ }
+
+-static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local,
+- struct ieee80211_vif *vif,
+- struct ieee80211_sta *pubsta,
+- struct sk_buff *skb)
+-{
+- struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+- struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+- struct ieee80211_txq *txq = NULL;
+-
+- if ((info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) ||
+- (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE))
+- return NULL;
+-
+- if (!ieee80211_is_data(hdr->frame_control))
+- return NULL;
+-
+- if (pubsta) {
+- u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
+-
+- txq = pubsta->txq[tid];
+- } else if (vif) {
+- txq = vif->txq;
+- }
+-
+- if (!txq)
+- return NULL;
+-
+- return to_txq_info(txq);
+-}
+-
+ static void ieee80211_set_skb_enqueue_time(struct sk_buff *skb)
+ {
+ IEEE80211_SKB_CB(skb)->control.enqueue_time = codel_get_time();
+@@ -3265,7 +3266,7 @@ static bool ieee80211_xmit_fast(struct i
+
+ if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
+ *ieee80211_get_qos_ctl(hdr) = tid;
+- if (!sta->sta.txq[0])
++ if (!ieee80211_get_txq(local, &sdata->vif, &sta->sta, skb))
+ hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
+ } else {
+ info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;