1 files changed, 29 insertions, 3 deletions

diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index ae344d1ba056..36305e0d06ef 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -458,8 +458,9 @@ ieee80211_direct_probe(struct ieee80211_work *wk)
                 return WORK_ACT_TIMEOUT;
         }
 
-        printk(KERN_DEBUG "%s: direct probe to %pM (try %d)\n",
-                        sdata->name, wk->filter_ta, wk->probe_auth.tries);
+        printk(KERN_DEBUG "%s: direct probe to %pM (try %d/%i)\n",
+               sdata->name, wk->filter_ta, wk->probe_auth.tries,
+               IEEE80211_AUTH_MAX_TRIES);
 
         /*
          * Direct probe is sent to broadcast address as some APs
@@ -561,6 +562,25 @@ ieee80211_remain_on_channel_timeout(struct ieee80211_work *wk)
 }
 
 static enum work_action __must_check
+ieee80211_offchannel_tx(struct ieee80211_work *wk)
+{
+        if (!wk->started) {
+                wk->timeout = jiffies + msecs_to_jiffies(wk->offchan_tx.wait);
+
+                /*
+                 * After this, offchan_tx.frame remains but now is no
+                 * longer a valid pointer -- we still need it as the
+                 * cookie for canceling this work.
+                 */
+                ieee80211_tx_skb(wk->sdata, wk->offchan_tx.frame);
+
+                return WORK_ACT_NONE;
+        }
+
+        return WORK_ACT_TIMEOUT;
+}
+
+static enum work_action __must_check
 ieee80211_assoc_beacon_wait(struct ieee80211_work *wk)
 {
         if (wk->started)
@@ -955,6 +975,9 @@ static void ieee80211_work_work(struct work_struct *work)
                 case IEEE80211_WORK_REMAIN_ON_CHANNEL:
                         rma = ieee80211_remain_on_channel_timeout(wk);
                         break;
+                case IEEE80211_WORK_OFFCHANNEL_TX:
+                        rma = ieee80211_offchannel_tx(wk);
+                        break;
                 case IEEE80211_WORK_ASSOC_BEACON_WAIT:
                         rma = ieee80211_assoc_beacon_wait(wk);
                         break;
@@ -1051,11 +1074,13 @@ void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_work *wk;
+        bool cleanup = false;
 
         mutex_lock(&local->mtx);
         list_for_each_entry(wk, &local->work_list, list) {
                 if (wk->sdata != sdata)
                         continue;
+                cleanup = true;
                 wk->type = IEEE80211_WORK_ABORT;
                 wk->started = true;
                 wk->timeout = jiffies;
@@ -1063,7 +1088,8 @@ void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
         mutex_unlock(&local->mtx);
 
         /* run cleanups etc. */
-        ieee80211_work_work(&local->work_work);
+        if (cleanup)
+                ieee80211_work_work(&local->work_work);
 
         mutex_lock(&local->mtx);
         list_for_each_entry(wk, &local->work_list, list) {