[PATCH v2 2/2] wifi: mac80211: send wake nullfunc when TIM bit is set while awake

[Lee Jones]

When an AP's Beacon TIM element indicates buffered unicast traffic for a
station's AID, the AP believes the station is in power-save mode.  If
the station is actually awake (IEEE80211_CONF_PS is not set) and
dynamic power-save is disabled (dynamic_ps_timeout == 0, for instance
when power-save is disabled on the interface), ieee80211_rx_mgmt_beacon()
currently takes neither the dynamic-PS wakeup branch nor the PS-Poll
branch.

As a result, if the AP's power-save state for the station becomes
desynchronised (for example, due to an unauthenticated frame with the PM
bit set), an awake client with power-save disabled ignores its AID bit
in the TIM and never transmits a nullfunc frame with PM=0 to flush the
AP's buffered frames.

Send a wake nullfunc frame in ieee80211_rx_mgmt_beacon() whenever the
TIM indicates buffered traffic for the station while IEEE80211_CONF_PS
is not set.

Fixes: 6f0756a38fc4 ("mac80211: do not send pspoll when powersave is disabled")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---

v1 => v2: New patch per Johannes Berg's review suggestion

 net/mac80211/mlme.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 6ec45a9f7221..802c714ba852 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -8286,7 +8286,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_link_data *link,
 	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
 	    ieee80211_check_tim(elems->tim, elems->tim_len, vif_cfg->aid,
 				vif_cfg->s1g)) {
-		if (local->hw.conf.dynamic_ps_timeout > 0) {
+		if (local->hw.conf.dynamic_ps_timeout > 0 ||
+		    !(local->hw.conf.flags & IEEE80211_CONF_PS)) {
 			if (local->hw.conf.flags & IEEE80211_CONF_PS) {
 				local->hw.conf.flags &= ~IEEE80211_CONF_PS;
 				ieee80211_hw_config(local, -1,
-- 
2.56.0.313.g2479322e68-goog