[PATCH] nl80211: Do not clear send_frame_cookie on TX wait expiration

[Andrei Otcheretianski]

From: Ilan Peer <ilan.peer at intel.com>

With mac80211 based drivers the NL80211_CMD_FRAME_WAIT_CANCEL can be
notified to user space while the driver is still handling the frame.
In such cases, when the driver is done handling the frame it would
indicate the frame handling status to mac80211, which would
trigger NL80211_CMD_FRAME_TX_STATUS notification to user space.

However, the nl80211 driver logic handling for
NL80211_CMD_FRAME_WAIT_CANCEL clears the send_frame_cookie, so when
the NL80211_CMD_FRAME_TX_STATUS arrives it is being ignored.
As a result, wpa_supplicant flows, e.g., P2P GoN confirm transmission
etc., are stuck (since Tx wait expiration is not handled by the
wpa_supplicant other than in the context of DPP).

Fix this issue by not clearing the send_frame_cookie as part of the
NL80211_CMD_FRAME_WAIT_CANCEL handling.

Signed-off-by: Ilan Peer <ilan.peer at intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski at intel.com>
---
 src/drivers/driver_nl80211_event.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/drivers/driver_nl80211_event.c b/src/drivers/driver_nl80211_event.c
index 29613161b9..c958eb66cc 100644
--- a/src/drivers/driver_nl80211_event.c
+++ b/src/drivers/driver_nl80211_event.c
@@ -3347,9 +3347,12 @@ static void nl80211_frame_wait_cancel(struct wpa_driver_nl80211_data *drv,
 		   (long long unsigned int) cookie,
 		   match ? " (match)" : "",
 		   drv->send_frame_cookie == cookie ? " (match-saved)" : "");
-	if (drv->send_frame_cookie == cookie)
-		drv->send_frame_cookie = (u64) -1;
-	if (!match)
+
+	/*
+	 * In case that the cookie matches the saved frame cookie the driver is
+	 * expected to indicate TX status
+	 */
+	if (!match || drv->send_frame_cookie == cookie)
 		return;
 
 	if (i < drv->num_send_frame_cookies - 1)
-- 
2.38.1