[PATCH v2 2/5] gas_server: wait for TX status before answering a Comeback Request

[Gustavo Bertoli]

A Comeback Request that arrives while the previous fragment's TX
status is still pending is not yet known to be missed. Responding to
it immediately supersedes the in-flight frame, so that frame's TX
status is reported against a stale cookie and lost; combined with the
rollback from the previous patch this can leave the entry parked, with
the final fragment never confirmed as delivered.

The duplicate Comeback Requests that trigger this arise from the
requester-side same-token retry added later in this series, and the
previous patch's no-ACK rollback is what keeps the entry alive to be
parked, so this hardens the recovery added by the series rather than
fixing a standalone problem.

Track a tx_pending flag and ignore a Comeback Request while the
previous fragment's TX status is pending; the frame answering it is
already in flight.

Signed-off-by: Gustavo Bertoli <gubertoli at gmail.com>
---
 src/common/gas_server.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/common/gas_server.c b/src/common/gas_server.c
index 012bf2939..80c75251a 100644
--- a/src/common/gas_server.c
+++ b/src/common/gas_server.c
@@ -38,6 +38,7 @@ struct gas_server_response {
 	size_t offset;
 	size_t last_offset;
 	u8 frag_id;
+	bool tx_pending;
 	struct wpabuf *resp;
 	int freq;
 	u8 dst[ETH_ALEN];
@@ -276,6 +277,11 @@ gas_server_handle_rx_comeback_req(struct gas_server_response *response)
 	struct wpabuf *resp;
 	unsigned int wait_time = 0;
 
+	if (response->tx_pending && response->resp) {
+		/* Previous fragment's TX status still pending; wait for it */
+		return;
+	}
+
 	if (!response->resp) {
 		resp = gas_build_comeback_resp(response->dialog_token,
 					       WLAN_STATUS_SUCCESS, 0, 0,
@@ -341,6 +347,7 @@ gas_server_handle_rx_comeback_req(struct gas_server_response *response)
 
 send_resp:
 	gas->tx(gas->ctx, response->freq, response->dst, resp, wait_time);
+	response->tx_pending = true;
 	wpabuf_free(resp);
 }
 
@@ -419,6 +426,8 @@ int gas_server_rx(struct gas_server *gas, const u8 *da, const u8 *sa,
 static void gas_server_handle_tx_status(struct gas_server_response *response,
 					int ack)
 {
+	response->tx_pending = false;
+
 	if (ack && response->resp &&
 	    response->offset < wpabuf_len(response->resp)) {
 		wpa_printf(MSG_DEBUG,
-- 
2.39.5