mac80211: fix PS-poll response, race

When a station queries us for a PS-poll response, we wrongly
queue the frame on the virtual interface's queue rather than
the pending queue.

Additionally, fix a race condition where we could potentially
send multiple frames to the sleeping station due to using a
station flag rather than a packet flag. When converting to a
packet flag, we can also convert p54 and remove the filter
clearing we added for it.

(Also remove a now dead function)

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Reported-by: Bob Copeland <me@bobcopeland.com>
Tested-by: Bob Copeland <me@bobcopeland.com>
Cc: Christian Lamparter <chunkeey@web.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 1 insertions, 18 deletions

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 70ff4f065665..edacad1fb1dc 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -373,7 +373,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         staflags = get_sta_flags(sta);
 
         if (unlikely((staflags & WLAN_STA_PS) &&
-                     !(staflags & WLAN_STA_PSPOLL))) {
+                     !(info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE))) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "STA %pM aid %d: PS buffer (entries "
                        "before %d)\n",
@@ -412,24 +412,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                        sta->sta.addr);
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
-        if (test_and_clear_sta_flags(sta, WLAN_STA_PSPOLL)) {
-                /*
-                 * The sleeping station with pending data is now snoozing.
-                 * It queried us for its buffered frames and will go back
-                 * to deep sleep once it got everything.
-                 *
-                 * inform the driver, in case the hardware does powersave
-                 * frame filtering and keeps a station  blacklist on its own
-                 * (e.g: p54), so that frames can be delivered unimpeded.
-                 *
-                 * Note: It should be safe to disable the filter now.
-                 * As, it is really unlikely that we still have any pending
-                 * frame for this station in the hw's buffers/fifos left,
-                 * that is not rejected with a unsuccessful tx_status yet.
-                 */
 
-                info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
-        }
         return TX_CONTINUE;
 }