diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index f4db30624f6780fbe6af6271746dd76b5a77a147..9b179309e073ed02a2879054cee4ee292467f3d8 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2088,7 +2088,8 @@ static int ieee80211_set_mcast_rate(struct wiphy *wiphy, struct net_device *dev,
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-	memcpy(sdata->vif.bss_conf.mcast_rate, rate, sizeof(rate));
+	memcpy(sdata->vif.bss_conf.mcast_rate, rate,
+	       sizeof(int) * IEEE80211_NUM_BANDS);
 
 	return 0;
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 99be3b61a225621ebeae53acbf132de00db18bea..ac1374a8c30a66934598f67d2852819ee12cca0f 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3488,6 +3488,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
 
 	ret = 0;
 
+out:
 	while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
 					IEEE80211_CHAN_DISABLED)) {
 		if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
@@ -3496,14 +3497,13 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
 			goto out;
 		}
 
-		ret = chandef_downgrade(chandef);
+		ret |= chandef_downgrade(chandef);
 	}
 
 	if (chandef->width != vht_chandef.width)
 		sdata_info(sdata,
-			   "local regulatory prevented using AP HT/VHT configuration, downgraded\n");
+			   "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
 
-out:
 	WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
 	return ret;
 }
@@ -3617,8 +3617,11 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
 	 */
 	ret = ieee80211_vif_use_channel(sdata, &chandef,
 					IEEE80211_CHANCTX_SHARED);
-	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT)
+	while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
 		ifmgd->flags |= chandef_downgrade(&chandef);
+		ret = ieee80211_vif_use_channel(sdata, &chandef,
+						IEEE80211_CHANCTX_SHARED);
+	}
 	return ret;
 }
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index f0d9b5154babf39566d6374b600ed040fb25bee1..674aadca007982257b14b3c68abbafc39ee01461 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1398,7 +1398,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
 						  &iwe, IW_EV_UINT_LEN);
 	}
 
-	buf = kmalloc(30, GFP_ATOMIC);
+	buf = kmalloc(31, GFP_ATOMIC);
 	if (buf) {
 		memset(&iwe, 0, sizeof(iwe));
 		iwe.cmd = IWEVCUSTOM;