[PATCH v2 1/2] wifi: mac80211: ignore PM bit in non-bufferable MMPDUs

[Lee Jones]

In AP mode, the Power Management (PM) subfield in the Frame Control
header is reserved in non-bufferable management frames (such as Probe
Request, Authentication, and (Re)Association Request).  Transmitters set
reserved subfields to zero and receivers are expected to ignore them.

Commit 9fef65443388 ("mac80211: always update the PM state of a peer on
MGMT / DATA frames") removed the bufferable MMPDU check from
ieee80211_rx_h_sta_process() so that a sleeping station that disappears
and later re-authenticates transitions back to awake (sta_ps_end()).
However, removing the check altogether caused the AP to honour the
reserved PM bit on all non-bufferable management frames in both
directions:

 - A sleeping station transmitting a non-bufferable MMPDU with the
   reserved PM bit set to 0 (for example, a Probe Request) is
   spuriously transitioned out of power-save mode.

 - An awake station for which a non-bufferable MMPDU with the reserved
   PM bit set to 1 is received (for example, a spoofed Association
   Request) is transitioned into power-save mode, causing the AP to
   buffer subsequent frames such as SA Query Requests.

Only inspect the PM bit on data frames and bufferable management frame
subtypes (Action, Disassociation, and Deauthentication) via
hdr->frame_control, avoiding inspection of encrypted Action payloads
prior to ieee80211_rx_h_decrypt().  For Authentication and
(Re)Association Request frames, where a station is always in Active
mode per IEEE 802.11, transition a sleeping station to awake without
consulting the reserved PM bit.

Fixes: 9fef65443388 ("mac80211: always update the PM state of a peer on MGMT / DATA frames")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
---

v1 => v2:
 - Make non-bufferable MMPDU PM-bit handling symmetric across both wake-to-doze and doze-to-wake transitions
 - Expand commit description explaining both transitions and why Authentication/(Re)Association Request still wake sleeping stations

 net/mac80211/rx.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index ecee9348c70d..29383fc85a63 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1920,12 +1920,22 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
 	    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
 	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
 	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
-		if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
-			if (!ieee80211_has_pm(hdr->frame_control))
-				sta_ps_end(sta);
-		} else {
-			if (ieee80211_has_pm(hdr->frame_control))
-				sta_ps_start(sta);
+		if (ieee80211_is_data(hdr->frame_control) ||
+		    ieee80211_is_action(hdr->frame_control) ||
+		    ieee80211_is_disassoc(hdr->frame_control) ||
+		    ieee80211_is_deauth(hdr->frame_control)) {
+			if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
+				if (!ieee80211_has_pm(hdr->frame_control))
+					sta_ps_end(sta);
+			} else {
+				if (ieee80211_has_pm(hdr->frame_control))
+					sta_ps_start(sta);
+			}
+		} else if (test_sta_flag(sta, WLAN_STA_PS_STA) &&
+			   (ieee80211_is_auth(hdr->frame_control) ||
+			    ieee80211_is_assoc_req(hdr->frame_control) ||
+			    ieee80211_is_reassoc_req(hdr->frame_control))) {
+			sta_ps_end(sta);
 		}
 	}
 
-- 
2.56.0.313.g2479322e68-goog