mac80211: Fix incorrect num_sta_ps decrement in __sta_info_destroy

When WLAN_STA_PS_DRIVER is set by ieee80211_sta_block_awake the
num_sta_ps counter is not incremented. Hence, we shouldn't decrement
it in __sta_info_destroy if only WLAN_STA_PS_DRIVER is set. This
could result in an incorrect num_sta_ps counter leading to strange side
effects with associated powersaving clients.

Fix this by only decrementing num_sta_ps when WLAN_STA_PS_STA was set
before.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 1 insertions, 3 deletions

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index df8f0a2f0dee..0c79593b1bbf 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -750,12 +750,10 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
 
         sta->dead = true;
 
-        if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
-            test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
+        if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
                 BUG_ON(!sdata->bss);
 
                 clear_sta_flag(sta, WLAN_STA_PS_STA);
-                clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 
                 atomic_dec(&sdata->bss->num_sta_ps);
                 sta_info_recalc_tim(sta);