mac80211: Stop TX BA session if buf_size is zero

If we receive an ADDBA response with status code 0 and a buf_size of 0
we should stop the TX BA session as otherwise we'll end up queuing
frames in ieee80211_tx_prep_agg forever instead of sending them out as
non AMPDUs.

This fixes a problem with AVM Fritz Stick N wireless devices where
frames to this device are not transmitted anymore by mac80211.

Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index c8be8eff70daa5595b823c8648a1261153fe71b1..b7075f33dc06c2eb997469fdf955408d8fce709d 100644 (file)
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -777,18 +777,14 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 #ifdef CONFIG_MAC80211_HT_DEBUG
        printk(KERN_DEBUG "switched off addBA timer for tid %d\n", tid);
 #endif
-
+       /*
+        * IEEE 802.11-2007 7.3.1.14:
+        * In an ADDBA Response frame, when the Status Code field
+        * is set to 0, the Buffer Size subfield is set to a value
+        * of at least 1.
+        */
        if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
-                       == WLAN_STATUS_SUCCESS) {
-               /*
-                * IEEE 802.11-2007 7.3.1.14:
-                * In an ADDBA Response frame, when the Status Code field
-                * is set to 0, the Buffer Size subfield is set to a value
-                * of at least 1.
-                */
-               if (!buf_size)
-                       goto out;
-
+                       == WLAN_STATUS_SUCCESS && buf_size) {
                if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED,
                                     &tid_tx->state)) {
                        /* ignore duplicate response */