mac80211: A-MPDU Rx handling aggregation reordering

This patch handles the reordering of the Rx A-MPDU.
This issue occurs when the sequence of the internal MPDUs is not in the
right order. such a case can be encountered for example when some MPDUs from
previous aggregations were recieved, while others failed, so current A-MPDU
will contain a mix of re-transmited MPDUs and new ones.

Signed-off-by: Ron Rindjunsky <ron.rindjunsky@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 9 insertions, 1 deletions

diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index d5a7683fab3a..f1edaa0c0da3 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -1208,7 +1208,7 @@ void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct ieee80211_hw *hw = &local->hw;
         struct sta_info *sta;
-        int ret;
+        int ret, i;
 
         sta = sta_info_get(local, ra);
         if (!sta)
@@ -1250,6 +1250,14 @@ void ieee80211_sta_stop_rx_ba_session(struct net_device *dev, u8 *ra, u16 tid,
                 ieee80211_send_delba(dev, ra, tid, 0, reason);
 
         /* free the reordering buffer */
+        for (i = 0; i < sta->ampdu_mlme.tid_rx[tid].buf_size; i++) {
+                if (sta->ampdu_mlme.tid_rx[tid].reorder_buf[i]) {
+                        /* release the reordered frames */
+                        dev_kfree_skb(sta->ampdu_mlme.tid_rx[tid].reorder_buf[i]);
+                        sta->ampdu_mlme.tid_rx[tid].stored_mpdu_num--;
+                        sta->ampdu_mlme.tid_rx[tid].reorder_buf[i] = NULL;
+                }
+        }
         kfree(sta->ampdu_mlme.tid_rx[tid].reorder_buf);
 
         sta->ampdu_mlme.tid_rx[tid].state = HT_AGG_STATE_IDLE;