1 files changed, 22 insertions, 0 deletions

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 965b272499fd..58eab9e8e4ee 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -86,6 +86,7 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                      tid, 0, reason);
 
         del_timer_sync(&tid_rx->session_timer);
+        del_timer_sync(&tid_rx->reorder_timer);
 
         call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
 }
@@ -120,6 +121,20 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
         ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
 }
 
+static void sta_rx_agg_reorder_timer_expired(unsigned long data)
+{
+        u8 *ptid = (u8 *)data;
+        u8 *timer_to_id = ptid - *ptid;
+        struct sta_info *sta = container_of(timer_to_id, struct sta_info,
+                        timer_to_tid[0]);
+
+        rcu_read_lock();
+        spin_lock(&sta->lock);
+        ieee80211_release_reorder_timeout(sta, *ptid);
+        spin_unlock(&sta->lock);
+        rcu_read_unlock();
+}
+
 static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
                                       u8 dialog_token, u16 status, u16 policy,
                                       u16 buf_size, u16 timeout)
@@ -251,11 +266,18 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                 goto end;
         }
 
+        spin_lock_init(&tid_agg_rx->reorder_lock);
+
         /* rx timer */
         tid_agg_rx->session_timer.function = sta_rx_agg_session_timer_expired;
         tid_agg_rx->session_timer.data = (unsigned long)&sta->timer_to_tid[tid];
         init_timer(&tid_agg_rx->session_timer);
 
+        /* rx reorder timer */
+        tid_agg_rx->reorder_timer.function = sta_rx_agg_reorder_timer_expired;
+        tid_agg_rx->reorder_timer.data = (unsigned long)&sta->timer_to_tid[tid];
+        init_timer(&tid_agg_rx->reorder_timer);
+
         /* prepare reordering buffer */
         tid_agg_rx->reorder_buf =
                 kcalloc(buf_size, sizeof(struct sk_buff *), GFP_ATOMIC);