--- /dev/null
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -690,10 +690,10 @@ static u16 ieee80211_monitor_select_queu
+ return 0;
+
+ if (skb->len < 4 ||
+- skb->len < rtap->it_len + 2 /* frame control */)
++ skb->len < le16_to_cpu(rtap->it_len) + 2 /* frame control */)
+ return 0; /* doesn't matter, frame will be dropped */
+
+- hdr = (void *)((u8 *)skb->data + rtap->it_len);
++ hdr = (void *)((u8 *)skb->data + le16_to_cpu(rtap->it_len));
+
+ if (!ieee80211_is_data(hdr->frame_control)) {
+ skb->priority = 7;
--- /dev/null
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -685,6 +685,7 @@ static u16 ieee80211_monitor_select_queu
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_hdr *hdr;
+ struct ieee80211_radiotap_header *rtap = (void *)skb->data;
++ u8 *p;
+
+ if (local->hw.queues < 4)
+ return 0;
+@@ -695,11 +696,14 @@ static u16 ieee80211_monitor_select_queu
+
+ hdr = (void *)((u8 *)skb->data + le16_to_cpu(rtap->it_len));
+
+- if (!ieee80211_is_data(hdr->frame_control)) {
++ if (!ieee80211_is_data_qos(hdr->frame_control)) {
+ skb->priority = 7;
+ return ieee802_1d_to_ac[skb->priority];
+ }
+
++ p = ieee80211_get_qos_ctl(hdr);
++ skb->priority = *p & IEEE80211_QOS_CTL_TAG1D_MASK;
++
+ return ieee80211_downgrade_queue(local, skb);
+ }
+