mac80211: don't reorder frames with SN smaller than SSN (2159c30e) · Commits · e / devices / android_kernel_fairphone_FP3

net/mac80211/agg-rx.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -398,6 +398,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
		tid_agg_rx->timeout = timeout;
		tid_agg_rx->stored_mpdu_num = 0;
		tid_agg_rx->auto_seq = auto_seq;
		tid_agg_rx->started = false;
		tid_agg_rx->reorder_buf_filtered = 0;
		status = WLAN_STATUS_SUCCESS;

+13 −1

Original line number	Diff line number	Diff line
		@@ -4,7 +4,7 @@
		* Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
		* Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
		* Copyright 2013-2014 Intel Mobile Communications GmbH
		* Copyright(c) 2015 - 2016 Intel Deutschland GmbH
		* Copyright(c) 2015 - 2017 Intel Deutschland GmbH
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 as
		@@ -1034,6 +1034,18 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
		buf_size = tid_agg_rx->buf_size;
		head_seq_num = tid_agg_rx->head_seq_num;

		/*
		* If the current MPDU's SN is smaller than the SSN, it shouldn't
		* be reordered.
		*/
		if (unlikely(!tid_agg_rx->started)) {
		if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
		ret = false;
		goto out;
		}
		tid_agg_rx->started = true;
		}

		/* frame with out of date sequence number */
		if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
		dev_kfree_skb(skb);

+4 −2

Original line number	Diff line number	Diff line
		@@ -189,6 +189,7 @@ struct tid_ampdu_tx {
		* @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
		* and ssn.
		* @removed: this session is removed (but might have been found due to RCU)
		* @started: this session has started (head ssn or higher was received)
		*
		* This structure's lifetime is managed by RCU, assignments to
		* the array holding it must hold the aggregation mutex.
		@@ -212,8 +213,9 @@ struct tid_ampdu_rx {
		u16 ssn;
		u16 buf_size;
		u16 timeout;
		bool auto_seq;
		bool removed;
		u8 auto_seq:1,
		removed:1,
		started:1;
		};

		/**