nl80211: Cancel not yet started r-o-c

Currently, the following can happen:

1) P2P state machine requests R-O-C
2) user changes their mind and aborts
3) P2P state machine aborts R-O-C
4) driver_nl80211 rejects abort since there
   was no notification about the start yet
5) R-O-C period start notification from kernel
6) P2P state machine requests new R-O-C
7) this overlaps with old R-O-C -- iwlwifi driver
   can't handle that and returns -EBUSY
8) state machine stops dead in its tracks

The reason is that the abort isn't going through properly. Instead of
tracking whether a R-O-C is active in driver_nl80211, track whether one
was requested to avoid this scenario.

Reported-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index c2fa19a5bcabad6ab87605dbe0041985c5a77760..19893255cbe9af26758ae19e73fdd0a027e45949 100644 (file)
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -1089,7 +1089,8 @@ static void mlme_event_remain_on_channel(struct wpa_driver_nl80211_data *drv,
        if (cookie != drv->remain_on_chan_cookie)
                return; /* not for us */
 
-       drv->pending_remain_on_chan = !cancel_event;
+       if (cancel_event)
+               drv->pending_remain_on_chan = 0;
 
        os_memset(&data, 0, sizeof(data));
        data.remain_on_channel.freq = freq;
@@ -6555,6 +6556,7 @@ static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
                           "0x%llx for freq=%u MHz duration=%u",
                           (long long unsigned int) cookie, freq, duration);
                drv->remain_on_chan_cookie = cookie;
+               drv->pending_remain_on_chan = 1;
                return 0;
        }
        wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "