mac80211: don't drop nullfunc frames during software scan

ieee80211_tx_h_check_assoc() was dropping everything else than probe
requests during software scan. So the nullfunc frame with the power save
bit was dropped and AP never received it. This meant that AP never
buffered any frames for the station during software scan.

Fix this by allowing to transmit both probe request and nullfunc frames
during software scan. Tested with stlc45xx.

Signed-off-by: Kalle Valo <kalle.valo@nokia.com>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 13 insertions, 1 deletions

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 038460b0a48a..f3f240c69018 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -193,7 +193,19 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
                 return TX_CONTINUE;
 
         if (unlikely(tx->local->sw_scanning) &&
-            !ieee80211_is_probe_req(hdr->frame_control))
+            !ieee80211_is_probe_req(hdr->frame_control) &&
+            !ieee80211_is_nullfunc(hdr->frame_control))
+                /*
+                 * When software scanning only nullfunc frames (to notify
+                 * the sleep state to the AP) and probe requests (for the
+                 * active scan) are allowed, all other frames should not be
+                 * sent and we should not get here, but if we do
+                 * nonetheless, drop them to avoid sending them
+                 * off-channel. See the link below and
+                 * ieee80211_start_scan() for more.
+                 *
+                 * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089
+                 */
                 return TX_DROP;
 
         if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)