mac80211: free ps->bc_buf skbs on vlan device stop

When the vlan device is removed, ps->bc_buf processing can no longer
send its frames.

Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 14 insertions, 0 deletions

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index e9223ce2bf99..86c83084542a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -680,6 +680,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb, *tmp;
         u32 hw_reconf_flags = 0;
         int i, flushed;
+        struct ps_data *ps;
 
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 
@@ -768,6 +769,19 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                                          u.vlan.list)
                         dev_close(vlan->dev);
                 WARN_ON(!list_empty(&sdata->u.ap.vlans));
+        } else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                /* remove all packets in parent bc_buf pointing to this dev */
+                ps = &sdata->bss->ps;
+
+                spin_lock_irqsave(&ps->bc_buf.lock, flags);
+                skb_queue_walk_safe(&ps->bc_buf, skb, tmp) {
+                        if (skb->dev == sdata->dev) {
+                                __skb_unlink(skb, &ps->bc_buf);
+                                local->total_ps_buffered--;
+                                ieee80211_free_txskb(&local->hw, skb);
+                        }
+                }
+                spin_unlock_irqrestore(&ps->bc_buf.lock, flags);
         } else if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 ieee80211_mgd_stop(sdata);
         }