Fix driver-offloaded offchannel TX done processing

It was possible for a Action frame sequence completion to stop an
ongoing offchannel remain-on-channel operation unexpectedly in cases
where TX operation was offloaded to the driver and such an operation
happened to occur during a previously started remain-on-channel (e.g.,
for P2P listen state).

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/wpa_supplicant/offchannel.c b/wpa_supplicant/offchannel.c
index 7a863476dd71e3bb689ef9498090413cdff5f8dd..63af83afe1985e9062a2672d4af0fc34703236d7 100644 (file)
--- a/wpa_supplicant/offchannel.c
+++ b/wpa_supplicant/offchannel.c
@@ -354,15 +354,18 @@ int offchannel_send_action(struct wpa_supplicant *wpa_s, unsigned int freq,
  */
 void offchannel_send_action_done(struct wpa_supplicant *wpa_s)
 {
-       wpa_printf(MSG_DEBUG, "Off-channel: Action frame sequence done "
-                  "notification");
+       wpa_printf(MSG_DEBUG,
+                  "Off-channel: Action frame sequence done notification: pending_action_tx=%p drv_offchan_tx=%d action_tx_wait_time=%d off_channel_freq=%d roc_waiting_drv_freq=%d",
+                  wpa_s->pending_action_tx,
+                  !!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX),
+                  wpa_s->action_tx_wait_time, wpa_s->off_channel_freq,
+                  wpa_s->roc_waiting_drv_freq);
        wpabuf_free(wpa_s->pending_action_tx);
        wpa_s->pending_action_tx = NULL;
        if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX &&
            wpa_s->action_tx_wait_time)
                wpa_drv_send_action_cancel_wait(wpa_s);
-
-       if (wpa_s->off_channel_freq || wpa_s->roc_waiting_drv_freq) {
+       else if (wpa_s->off_channel_freq || wpa_s->roc_waiting_drv_freq) {
                wpa_drv_cancel_remain_on_channel(wpa_s);
                wpa_s->off_channel_freq = 0;
                wpa_s->roc_waiting_drv_freq = 0;