wifi: rtw89: TX nulldata 0 after scan complete

HW scan leak to TX nulldata 0 to AP after scan completed, which allowed
AP start to TX packet to us. Therefore, driver TX nulldata 0 after scan
completed.

Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250610130034.14692-7-pkshih@realtek.com

diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 130e89743991b985b982a46906da9a11b3886ab7..9c4360df77f17b25370004c6adf89f755f8f475f 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -5205,6 +5205,7 @@ void rtw89_core_scan_complete(struct rtw89_dev *rtwdev,
 {
        struct ieee80211_bss_conf *bss_conf;
        struct rtw89_bb_ctx *bb;
+       int ret;
 
        if (!rtwvif_link)
                return;
@@ -5224,6 +5225,14 @@ void rtw89_core_scan_complete(struct rtw89_dev *rtwdev,
        rtw89_phy_config_edcca(rtwdev, bb, false);
        rtw89_tas_scan(rtwdev, false);
 
+       if (hw_scan) {
+               ret = rtw89_core_send_nullfunc(rtwdev, rtwvif_link, false, false,
+                                              RTW89_SCAN_NULL_TIMEOUT);
+               if (ret)
+                       rtw89_debug(rtwdev, RTW89_DBG_TXRX,
+                                   "scan send null-0 failed: %d\n", ret);
+       }
+
        rtwdev->scanning = false;
        rtw89_for_each_active_bb(rtwdev, bb)
                bb->dig.bypass_dig = true;

diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h
index ce2f133138266251fafa29183a5165ae1489c8e7..c017bdaf0500e734bedda095a902a3e459913b76 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/core.h
+++ b/drivers/net/wireless/realtek/rtw89/core.h
@@ -3440,6 +3440,8 @@ struct rtw89_tx_skb_data {
        u8 hci_priv[];
 };
 
+#define RTW89_SCAN_NULL_TIMEOUT 30
+
 #define RTW89_ROC_IDLE_TIMEOUT 500
 #define RTW89_ROC_TX_TIMEOUT 30
 enum rtw89_roc_state {