From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Message-Id: <20120217005536.001809161@linuxfoundation.org> Date: Thu, 16 Feb 2012 16:55:48 -0800 From: Greg KH To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Eliad Peller , Johannes Berg , "John W. Linville" Subject: [14/28] mac80211: timeout a single frame in the rx reorder buffer In-Reply-To: <20120217005609.GA17081@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: 3.2-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eliad Peller commit 07ae2dfcf4f7143ce191c6436da1c33f179af0d6 upstream. The current code checks for stored_mpdu_num > 1, causing the reorder_timer to be triggered indefinitely, but the frame is never timed-out (until the next packet is received) Signed-off-by: Eliad Peller Acked-by: Johannes Berg Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman --- net/mac80211/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -616,7 +616,7 @@ static void ieee80211_sta_reorder_releas index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size; if (!tid_agg_rx->reorder_buf[index] && - tid_agg_rx->stored_mpdu_num > 1) { + tid_agg_rx->stored_mpdu_num) { /* * No buffers ready to be released, but check whether any * frames in the reorder buffer have timed out.