[PATCH wireless-next 2/2] wifi: nxpwifi: delete the station entry on the uAP deauth event

[Linmao Li]

When a station leaves, the firmware reports EVENT_UAP_STA_DEAUTH.
nxpwifi_uap_event_sta_deauth() tears down the reorder, BA and WMM state
for that peer but leaves its nxpwifi_sta_node on priv->sta_list.

Nothing else removes it.  cfg80211_del_sta() only reports the departure
upwards, it does not call back into cfg80211_ops.del_station, and that
callback is the only caller of nxpwifi_del_sta_entry().  The entry
therefore survives until the BSS goes idle and
nxpwifi_del_all_sta_list() drops everything.

Until then the departed station still looks associated to the driver.
nxpwifi_handle_uap_rx_forward() finds the stale node for that address,
treats the frame as intra-BSS traffic and requeues it for transmission
instead of passing it up the stack, so traffic for that address is
misrouted.  The list also keeps one entry per station that has ever
associated, and a station that comes back reuses the stale node along
with its old statistics.

mwifiex, which nxpwifi was derived from, deletes the entry in the same
event handler.

Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@xxxxxxxxxx>
---
 drivers/net/wireless/nxp/nxpwifi/uap_event.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/nxp/nxpwifi/uap_event.c b/drivers/net/wireless/nxp/nxpwifi/uap_event.c
index 9f717a3d7ec5d..f053a5db01ab7 100644
--- a/drivers/net/wireless/nxp/nxpwifi/uap_event.c
+++ b/drivers/net/wireless/nxp/nxpwifi/uap_event.c
@@ -75,6 +75,7 @@ nxpwifi_uap_event_sta_deauth(struct nxpwifi_private *priv)
 		nxpwifi_del_tx_ba_stream_tbl_by_ra(priv, deauth_mac);
 	}
 	nxpwifi_wmm_del_peer_ra_list(priv, deauth_mac);
+	nxpwifi_del_sta_entry(priv, deauth_mac);
 
 	return 0;
 }
-- 
2.25.1