mac80211: Add flushes before going off-channel

We've got a couple of races when enabling powersave with an AP for
off-channel operation. The first is fairly simple. If we go off-channel
before the nullfunc frame to enable PS is transmitted then it may not be
received by the AP. Add a flush after enabling off-channel PS to prevent
this from happening.

The second race is a bit more subtle. If the driver supports QoS and has
frames queued when the nullfunc frame is queued, those frames may get
transmitted after the nullfunc frame. If PM is not set then the AP is
being told that we've exited PS before we go off-channel and may try to
deliver frames. To prevent this, add a flush after stopping the queues
but before passing the nullfunc frame to the driver.

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

2 files changed, 8 insertions, 0 deletions

diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 4c3ee3e8285c..cc79b4a2e821 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -114,8 +114,13 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
          * STA interfaces.
          */
 
+        /*
+         * Stop queues and transmit all frames queued by the driver
+         * before sending nullfunc to enable powersave at the AP.
+         */
         ieee80211_stop_queues_by_reason(&local->hw,
                                         IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL);
+        drv_flush(local, false);
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index d9e2df96f676..6d0b89e4aa31 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -334,6 +334,9 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
 
         ieee80211_offchannel_stop_vifs(local);
 
+        /* ensure nullfunc is transmitted before leaving operating channel */
+        drv_flush(local, false);
+
         ieee80211_configure_filter(local);
 
         /* We need to set power level at maximum rate for scanning. */