/* first process frames */
        while ((skb = skb_dequeue(&sdata->skb_queue))) {
-               switch (sdata->vif.type) {
+               struct ieee80211_mgmt *mgmt = (void *)skb->data;
+
+               if (ieee80211_is_action(mgmt->frame_control) &&
+                   mgmt->u.action.category == WLAN_CATEGORY_BACK) {
+                       int len = skb->len;
+                       struct sta_info *sta;
+
+                       rcu_read_lock();
+                       sta = sta_info_get(sdata, mgmt->sa);
+                       if (sta) {
+                               switch (mgmt->u.action.u.addba_req.action_code) {
+                               case WLAN_ACTION_ADDBA_REQ:
+                                       ieee80211_process_addba_request(
+                                                       local, sta, mgmt, len);
+                                       break;
+                               case WLAN_ACTION_ADDBA_RESP:
+                                       ieee80211_process_addba_resp(local, sta,
+                                                                    mgmt, len);
+                                       break;
+                               case WLAN_ACTION_DELBA:
+                                       ieee80211_process_delba(sdata, sta,
+                                                               mgmt, len);
+                                       break;
+                               default:
+                                       WARN_ON(1);
+                                       break;
+                               }
+                       }
+                       rcu_read_unlock();
+               } else switch (sdata->vif.type) {
                case NL80211_IFTYPE_STATION:
                        ieee80211_sta_rx_queued_mgmt(sdata, skb);
                        break;
 
                        break;
                case IEEE80211_STYPE_ACTION:
                        switch (mgmt->u.action.category) {
-                       case WLAN_CATEGORY_BACK: {
-                               struct ieee80211_local *local = sdata->local;
-                               int len = skb->len;
-                               struct sta_info *sta;
-
-                               rcu_read_lock();
-                               sta = sta_info_get(sdata, mgmt->sa);
-                               if (!sta) {
-                                       rcu_read_unlock();
-                                       break;
-                               }
-
-                               local_bh_disable();
-
-                               switch (mgmt->u.action.u.addba_req.action_code) {
-                               case WLAN_ACTION_ADDBA_REQ:
-                                       if (len < (IEEE80211_MIN_ACTION_SIZE +
-                                                  sizeof(mgmt->u.action.u.addba_req)))
-                                               break;
-                                       ieee80211_process_addba_request(local, sta, mgmt, len);
-                                       break;
-                               case WLAN_ACTION_ADDBA_RESP:
-                                       if (len < (IEEE80211_MIN_ACTION_SIZE +
-                                                  sizeof(mgmt->u.action.u.addba_resp)))
-                                               break;
-                                       ieee80211_process_addba_resp(local, sta, mgmt, len);
-                                       break;
-                               case WLAN_ACTION_DELBA:
-                                       if (len < (IEEE80211_MIN_ACTION_SIZE +
-                                                  sizeof(mgmt->u.action.u.delba)))
-                                               break;
-                                       ieee80211_process_delba(sdata, sta, mgmt, len);
-                                       break;
-                               }
-                               local_bh_enable();
-                               rcu_read_unlock();
-                               break;
-                               }
                        case WLAN_CATEGORY_SPECTRUM_MGMT:
                                ieee80211_sta_process_chanswitch(sdata,
                                                &mgmt->u.action.u.chan_switch.sw_elem,
 
                if (len < IEEE80211_MIN_ACTION_SIZE + 1)
                        break;
 
-               if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                       skb_queue_tail(&sdata->skb_queue, rx->skb);
-                       ieee80211_queue_work(&local->hw, &sdata->work);
-                       return RX_QUEUED;
-               }
-
                switch (mgmt->u.action.u.addba_req.action_code) {
                case WLAN_ACTION_ADDBA_REQ:
                        if (len < (IEEE80211_MIN_ACTION_SIZE +
                                   sizeof(mgmt->u.action.u.addba_req)))
-                               return RX_DROP_MONITOR;
-                       ieee80211_process_addba_request(local, rx->sta, mgmt, len);
-                       goto handled;
+                               goto invalid;
+                       break;
                case WLAN_ACTION_ADDBA_RESP:
                        if (len < (IEEE80211_MIN_ACTION_SIZE +
                                   sizeof(mgmt->u.action.u.addba_resp)))
-                               break;
-                       ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
-                       goto handled;
+                               goto invalid;
+                       break;
                case WLAN_ACTION_DELBA:
                        if (len < (IEEE80211_MIN_ACTION_SIZE +
                                   sizeof(mgmt->u.action.u.delba)))
-                               break;
-                       ieee80211_process_delba(sdata, rx->sta, mgmt, len);
-                       goto handled;
+                               goto invalid;
+                       break;
+               default:
+                       goto invalid;
                }
-               break;
+
+               skb_queue_tail(&sdata->skb_queue, rx->skb);
+               ieee80211_queue_work(&local->hw, &sdata->work);
+               return RX_QUEUED;
        case WLAN_CATEGORY_SPECTRUM_MGMT:
                if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
                        break;
                return RX_QUEUED;
        }
 
+ invalid:
        /*
         * For AP mode, hostapd is responsible for handling any action
         * frames that we didn't handle, including returning unknown