mac80211: Add flushes before going off-channel

We've got a couple of races when enabling powersave with an AP for
off-channel operation. The first is fairly simple. If we go off-channel
before the nullfunc frame to enable PS is transmitted then it may not be
received by the AP. Add a flush after enabling off-channel PS to prevent
this from happening.

The second race is a bit more subtle. If the driver supports QoS and has
frames queued when the nullfunc frame is queued, those frames may get
transmitted after the nullfunc frame. If PM is not set then the AP is
being told that we've exited PS before we go off-channel and may try to
deliver frames. To prevent this, add a flush after stopping the queues
but before passing the nullfunc frame to the driver.

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 4c3ee3e8285c139dc7b7348e322de77a6139ad8a..cc79b4a2e821c9232c41135da3f4397dbba67b8d 100644 (file)
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -114,8 +114,13 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
         * STA interfaces.
         */
 
+       /*
+        * Stop queues and transmit all frames queued by the driver
+        * before sending nullfunc to enable powersave at the AP.
+        */
        ieee80211_stop_queues_by_reason(&local->hw,
                                        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL);
+       drv_flush(local, false);
 
        mutex_lock(&local->iflist_mtx);
        list_for_each_entry(sdata, &local->interfaces, list) {

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index d9e2df96f676a0819b69cb303d4073dbf9f50615..6d0b89e4aa31a0f1004ec005db2115370d8d2c4f 100644 (file)
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -334,6 +334,9 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
 
        ieee80211_offchannel_stop_vifs(local);
 
+       /* ensure nullfunc is transmitted before leaving operating channel */
+       drv_flush(local, false);
+
        ieee80211_configure_filter(local);
 
        /* We need to set power level at maximum rate for scanning. */