releases/4.7.3/mac80211-fix-purging-multicast-ps-buffer-queue.patch

   1 From 6b07d9ca9b5363dda959b9582a3fc9c0b89ef3b5 Mon Sep 17 00:00:00 2001
   2 From: Felix Fietkau <nbd@nbd.name>
   3 Date: Tue, 2 Aug 2016 11:13:41 +0200
   4 Subject: mac80211: fix purging multicast PS buffer queue
   5
   6 From: Felix Fietkau <nbd@nbd.name>
   7
   8 commit 6b07d9ca9b5363dda959b9582a3fc9c0b89ef3b5 upstream.
   9
  10 The code currently assumes that buffered multicast PS frames don't have
  11 a pending ACK frame for tx status reporting.
  12 However, hostapd sends a broadcast deauth frame on teardown for which tx
  13 status is requested. This can lead to the "Have pending ack frames"
  14 warning on module reload.
  15 Fix this by using ieee80211_free_txskb/ieee80211_purge_tx_queue.
  16
  17 Signed-off-by: Felix Fietkau <nbd@nbd.name>
  18 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  19 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  20
  21 ---
  22  net/mac80211/cfg.c |    2 +-
  23  net/mac80211/tx.c  |    6 +++---
  24  2 files changed, 4 insertions(+), 4 deletions(-)
  25
  26 --- a/net/mac80211/cfg.c
  27 +++ b/net/mac80211/cfg.c
  28 @@ -869,7 +869,7 @@ static int ieee80211_stop_ap(struct wiph
  29
  30         /* free all potentially still buffered bcast frames */
  31         local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
  32 -       skb_queue_purge(&sdata->u.ap.ps.bc_buf);
  33 +       ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf);
  34
  35         mutex_lock(&local->mtx);
  36         ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
  37 --- a/net/mac80211/tx.c
  38 +++ b/net/mac80211/tx.c
  39 @@ -365,7 +365,7 @@ static void purge_old_ps_buffers(struct
  40                 skb = skb_dequeue(&ps->bc_buf);
  41                 if (skb) {
  42                         purged++;
  43 -                       dev_kfree_skb(skb);
  44 +                       ieee80211_free_txskb(&local->hw, skb);
  45                 }
  46                 total += skb_queue_len(&ps->bc_buf);
  47         }
  48 @@ -448,7 +448,7 @@ ieee80211_tx_h_multicast_ps_buf(struct i
  49         if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
  50                 ps_dbg(tx->sdata,
  51                        "BC TX buffer full - dropping the oldest frame\n");
  52 -               dev_kfree_skb(skb_dequeue(&ps->bc_buf));
  53 +               ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));
  54         } else
  55                 tx->local->total_ps_buffered++;
  56
  57 @@ -4055,7 +4055,7 @@ ieee80211_get_buffered_bc(struct ieee802
  58                         sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
  59                 if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
  60                         break;
  61 -               dev_kfree_skb_any(skb);
  62 +               ieee80211_free_txskb(hw, skb);
  63         }
  64
  65         info = IEEE80211_SKB_CB(skb);