tree 6a47ff6d40fd98f1cb373565a620beec921451e0
parent 2b78ac9bfc7483ba4bda9ad3d10dd4afcf88337c
author Daniel Halperin <dhalperi@cs.washington.edu> 1301007708 -0700
committer John W. Linville <linville@tuxdriver.com> 1301341322 -0400

mac80211: fix aggregation frame release during timeout

Suppose the aggregation reorder buffer looks like this:

x-T-R1-y-R2,

where x and y are frames that have not been received, T is a received
frame that has timed out, and R1,R2 are received frames that have not
yet timed out. The proper behavior in this scenario is to move the
window past x (skipping it), release T and R1, and leave the window at y
until y is received or R2 times out.

As written, this code will instead leave the window at R1, because it
has not yet timed out. Fix this by exiting the reorder loop only when
the frame that has not timed out AND there are skipped frames earlier in
the current valid window.

Signed-off-by: Daniel Halperin <dhalperi@cs.washington.edu>
Signed-off-by: John W. Linville <linville@tuxdriver.com>