mac80211: Deny TX BA session requests during disassociation

In associated state, when bringing an interface down, existing
BA sessions are torn down. When this is in progress, nothing
prevents mac80211 from accepting another BA session start request.

Use a new station flag to fix this.

Signed-off-by: Sujith <Sujith.Manoharan@atheros.com>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

3 files changed, 15 insertions, 1 deletions

diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 718fbcff84d2..5538e1b4a697 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -237,6 +237,14 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
             sdata->vif.type != NL80211_IFTYPE_AP)
                 return -EINVAL;
 
+        if (test_sta_flags(sta, WLAN_STA_DISASSOC)) {
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                printk(KERN_DEBUG "Disassociation is in progress. "
+                       "Denying BA session request\n");
+#endif
+                return -EINVAL;
+        }
+
         if (test_sta_flags(sta, WLAN_STA_SUSPEND)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Suspend in progress. "
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index ee9443dc20ff..bfc4a5070013 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -797,8 +797,10 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata)
 
         rcu_read_lock();
         sta = sta_info_get(sdata, bssid);
-        if (sta)
+        if (sta) {
+                set_sta_flags(sta, WLAN_STA_DISASSOC);
                 ieee80211_sta_tear_down_BA_sessions(sta);
+        }
         rcu_read_unlock();
 
         changed |= ieee80211_reset_erp_info(sdata);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 5ff611a35979..822d84522937 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -42,6 +42,9 @@
  *      be in the queues
  * @WLAN_STA_PSPOLL: Station sent PS-poll while driver was keeping
  *      station in power-save mode, reply when the driver unblocks.
+ * @WLAN_STA_DISASSOC: Disassociation in progress.
+ *      This is used to reject TX BA session requests when disassociation
+ *      is in progress.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH           = 1<<0,
@@ -57,6 +60,7 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_SUSPEND        = 1<<11,
         WLAN_STA_PS_DRIVER      = 1<<12,
         WLAN_STA_PSPOLL         = 1<<13,
+        WLAN_STA_DISASSOC       = 1<<14,
 };
 
 #define STA_TID_NUM 16