lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed,  1 Jul 2020 17:07:01 +0200
From:   Jerome Pouiller <>
        Greg Kroah-Hartman <>,
        Kalle Valo <>,
        "David S . Miller" <>,
        Jérôme Pouiller 
Subject: [PATCH 07/13] staging: wfx: fix unexpected calls to ieee80211_sta_set_buffered()

From: Jérôme Pouiller <>

When a station go to sleep, the driver receive the status REQUEUE and
forward this answer to mac80211. So, neither the driver, neither the
hardware buffer the frames. So the call to ieee80211_sta_set_buffered is

In add, it seems that mac80211 does not expect to receive
ieee80211_sta_set_buffered(false) after the station is asleep(). When
the device send data to a station, the following sequence can be

   - Mac80211 call wfx_sta_notify(awake).
   - The driver calls ieee80211_sta_set_buffered(true). Since the
     station is awake, its TIM is not set.
   - Mac80211 receive a power save notification from the station, so it
     calls wfx_sta_notify(asleep).
   - Then, since the driver has declared it has buffered some frames,
     the TIM of the station should be set. This action is delayed by
   - The device also notice the station go to sleep. It replies the
     REQUEUE status for the buffered frames. The driver forward this
     status to mac80211.
   - There is no more frames in queues, so the driver call
   - Mac80211 updates the TIM but since there is no frames buffered by
     the driver, it set the TIM for the station to 0.

Anyway, correctly use the ieee80211_sta_set_buffered() API solves the

Signed-off-by: Jérôme Pouiller <>
 drivers/staging/wfx/data_tx.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/staging/wfx/data_tx.c b/drivers/staging/wfx/data_tx.c
index dcec722afb174..3244a768345c5 100644
--- a/drivers/staging/wfx/data_tx.c
+++ b/drivers/staging/wfx/data_tx.c
@@ -225,7 +225,6 @@ static void wfx_tx_manage_pm(struct wfx_vif *wvif, struct ieee80211_hdr *hdr,
 		sta_priv = (struct wfx_sta_priv *)&sta->drv_priv;
-		ieee80211_sta_set_buffered(sta, tid, true);
@@ -471,8 +470,6 @@ static void wfx_tx_update_sta(struct wfx_vif *wvif, struct ieee80211_hdr *hdr)
 		WARN(!sta_priv->buffered[tid], "inconsistent notification");
-		if (!sta_priv->buffered[tid])
-			ieee80211_sta_set_buffered(sta, tid, false);
 	} else {
 		dev_dbg(wvif->wdev->dev, "%s: sta does not exist anymore\n",

Powered by blists - more mailing lists