mac80211: fix skb buffering issue
[safe/jmp/linux-2.6] / net / mac80211 / rx.c
index 96f13ad..5429699 100644 (file)
 #include "tkip.h"
 #include "wme.h"
 
-static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
-                                            struct tid_ampdu_rx *tid_agg_rx,
-                                            u16 head_seq_num);
-
 /*
  * monitor mode reception
  *
@@ -534,6 +530,242 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
        return RX_CONTINUE;
 }
 
+#define SEQ_MODULO 0x1000
+#define SEQ_MASK   0xfff
+
+static inline int seq_less(u16 sq1, u16 sq2)
+{
+       return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
+}
+
+static inline u16 seq_inc(u16 sq)
+{
+       return (sq + 1) & SEQ_MASK;
+}
+
+static inline u16 seq_sub(u16 sq1, u16 sq2)
+{
+       return (sq1 - sq2) & SEQ_MASK;
+}
+
+
+static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
+                                           struct tid_ampdu_rx *tid_agg_rx,
+                                           int index,
+                                           struct sk_buff_head *frames)
+{
+       struct ieee80211_supported_band *sband;
+       struct ieee80211_rate *rate = NULL;
+       struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
+       struct ieee80211_rx_status *status;
+
+       if (!skb)
+               goto no_frame;
+
+       status = IEEE80211_SKB_RXCB(skb);
+
+       /* release the reordered frames to stack */
+       sband = hw->wiphy->bands[status->band];
+       if (!(status->flag & RX_FLAG_HT))
+               rate = &sband->bitrates[status->rate_idx];
+       tid_agg_rx->stored_mpdu_num--;
+       tid_agg_rx->reorder_buf[index] = NULL;
+       __skb_queue_tail(frames, skb);
+
+no_frame:
+       tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
+}
+
+static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
+                                            struct tid_ampdu_rx *tid_agg_rx,
+                                            u16 head_seq_num,
+                                            struct sk_buff_head *frames)
+{
+       int index;
+
+       while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
+               index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
+                                                       tid_agg_rx->buf_size;
+               ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
+       }
+}
+
+/*
+ * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
+ * the skb was added to the buffer longer than this time ago, the earlier
+ * frames that have not yet been received are assumed to be lost and the skb
+ * can be released for processing. This may also release other skb's from the
+ * reorder buffer if there are no additional gaps between the frames.
+ */
+#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
+
+/*
+ * As this function belongs to the RX path it must be under
+ * rcu_read_lock protection. It returns false if the frame
+ * can be processed immediately, true if it was consumed.
+ */
+static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
+                                            struct tid_ampdu_rx *tid_agg_rx,
+                                            struct sk_buff *skb,
+                                            struct sk_buff_head *frames)
+{
+       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+       u16 sc = le16_to_cpu(hdr->seq_ctrl);
+       u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
+       u16 head_seq_num, buf_size;
+       int index;
+
+       buf_size = tid_agg_rx->buf_size;
+       head_seq_num = tid_agg_rx->head_seq_num;
+
+       /* frame with out of date sequence number */
+       if (seq_less(mpdu_seq_num, head_seq_num)) {
+               dev_kfree_skb(skb);
+               return true;
+       }
+
+       /*
+        * If frame the sequence number exceeds our buffering window
+        * size release some previous frames to make room for this one.
+        */
+       if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
+               head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
+               /* release stored frames up to new head to stack */
+               ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num,
+                                                frames);
+       }
+
+       /* Now the new frame is always in the range of the reordering buffer */
+
+       index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
+
+       /* check if we already stored this frame */
+       if (tid_agg_rx->reorder_buf[index]) {
+               dev_kfree_skb(skb);
+               return true;
+       }
+
+       /*
+        * If the current MPDU is in the right order and nothing else
+        * is stored we can process it directly, no need to buffer it.
+        */
+       if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
+           tid_agg_rx->stored_mpdu_num == 0) {
+               tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
+               return false;
+       }
+
+       /* put the frame in the reordering buffer */
+       tid_agg_rx->reorder_buf[index] = skb;
+       tid_agg_rx->reorder_time[index] = jiffies;
+       tid_agg_rx->stored_mpdu_num++;
+       /* release the buffer until next missing frame */
+       index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
+                                               tid_agg_rx->buf_size;
+       if (!tid_agg_rx->reorder_buf[index] &&
+           tid_agg_rx->stored_mpdu_num > 1) {
+               /*
+                * No buffers ready to be released, but check whether any
+                * frames in the reorder buffer have timed out.
+                */
+               int j;
+               int skipped = 1;
+               for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
+                    j = (j + 1) % tid_agg_rx->buf_size) {
+                       if (!tid_agg_rx->reorder_buf[j]) {
+                               skipped++;
+                               continue;
+                       }
+                       if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
+                                       HT_RX_REORDER_BUF_TIMEOUT))
+                               break;
+
+#ifdef CONFIG_MAC80211_HT_DEBUG
+                       if (net_ratelimit())
+                               printk(KERN_DEBUG "%s: release an RX reorder "
+                                      "frame due to timeout on earlier "
+                                      "frames\n",
+                                      wiphy_name(hw->wiphy));
+#endif
+                       ieee80211_release_reorder_frame(hw, tid_agg_rx,
+                                                       j, frames);
+
+                       /*
+                        * Increment the head seq# also for the skipped slots.
+                        */
+                       tid_agg_rx->head_seq_num =
+                               (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
+                       skipped = 0;
+               }
+       } else while (tid_agg_rx->reorder_buf[index]) {
+               ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
+               index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
+                                                       tid_agg_rx->buf_size;
+       }
+
+       return true;
+}
+
+/*
+ * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
+ * true if the MPDU was buffered, false if it should be processed.
+ */
+static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
+                                      struct sk_buff_head *frames)
+{
+       struct sk_buff *skb = rx->skb;
+       struct ieee80211_local *local = rx->local;
+       struct ieee80211_hw *hw = &local->hw;
+       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+       struct sta_info *sta = rx->sta;
+       struct tid_ampdu_rx *tid_agg_rx;
+       u16 sc;
+       int tid;
+
+       if (!ieee80211_is_data_qos(hdr->frame_control))
+               goto dont_reorder;
+
+       /*
+        * filter the QoS data rx stream according to
+        * STA/TID and check if this STA/TID is on aggregation
+        */
+
+       if (!sta)
+               goto dont_reorder;
+
+       tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
+
+       if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
+               goto dont_reorder;
+
+       tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
+
+       /* qos null data frames are excluded */
+       if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
+               goto dont_reorder;
+
+       /* new, potentially un-ordered, ampdu frame - process it */
+
+       /* reset session timer */
+       if (tid_agg_rx->timeout)
+               mod_timer(&tid_agg_rx->session_timer,
+                         TU_TO_EXP_TIME(tid_agg_rx->timeout));
+
+       /* if this mpdu is fragmented - terminate rx aggregation session */
+       sc = le16_to_cpu(hdr->seq_ctrl);
+       if (sc & IEEE80211_SCTL_FRAG) {
+               ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
+                       tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
+               dev_kfree_skb(skb);
+               return;
+       }
+
+       if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, frames))
+               return;
+
+ dont_reorder:
+       __skb_queue_tail(frames, skb);
+}
 
 static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
@@ -637,6 +869,9 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
        if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                return RX_CONTINUE;
 
+       /* start without a key */
+       rx->key = NULL;
+
        if (rx->sta)
                stakey = rcu_dereference(rx->sta->key);
 
@@ -1168,8 +1403,8 @@ ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
                             rx->key))
                        return -EACCES;
                /* BIP does not use Protected field, so need to check MMIE */
-               if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb)
-                            && ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
+               if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
+                            ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
                             rx->key))
                        return -EACCES;
                /*
@@ -1477,7 +1712,6 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                        mpp_path_add(proxied_addr, mpp_addr, sdata);
                } else {
                        spin_lock_bh(&mppath->state_lock);
-                       mppath->exp_time = jiffies;
                        if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
                                memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
                        spin_unlock_bh(&mppath->state_lock);
@@ -1512,7 +1746,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                        memset(info, 0, sizeof(*info));
                        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                        info->control.vif = &rx->sdata->vif;
-                       ieee80211_select_queue(local, fwd_skb);
+                       skb_set_queue_mapping(skb,
+                               ieee80211_select_queue(rx->sdata, fwd_skb));
+                       ieee80211_set_qos_hdr(local, skb);
                        if (is_multicast_ether_addr(fwd_hdr->addr1))
                                IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
                                                                fwded_mcast);
@@ -1589,7 +1825,7 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 }
 
 static ieee80211_rx_result debug_noinline
-ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
+ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
 {
        struct ieee80211_local *local = rx->local;
        struct ieee80211_hw *hw = &local->hw;
@@ -1619,7 +1855,8 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
                                  TU_TO_EXP_TIME(tid_agg_rx->timeout));
 
                /* release stored frames up to start of BAR */
-               ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num);
+               ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num,
+                                                frames);
                kfree_skb(skb);
                return RX_QUEUED;
        }
@@ -1868,7 +2105,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
        struct net_device *prev_dev = NULL;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
-       if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
+       if (status->flag & RX_FLAG_INTERNAL_CMTR)
                goto out_free_skb;
 
        if (skb_headroom(skb) < sizeof(*rthdr) &&
@@ -1929,7 +2166,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
        } else
                goto out_free_skb;
 
-       rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
+       status->flag |= RX_FLAG_INTERNAL_CMTR;
        return;
 
  out_free_skb:
@@ -1942,8 +2179,11 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
                                         struct sk_buff *skb,
                                         struct ieee80211_rate *rate)
 {
+       struct sk_buff_head reorder_release;
        ieee80211_rx_result res = RX_DROP_MONITOR;
 
+       __skb_queue_head_init(&reorder_release);
+
        rx->skb = skb;
        rx->sdata = sdata;
 
@@ -1951,50 +2191,72 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
        do {                            \
                res = rxh(rx);          \
                if (res != RX_CONTINUE) \
-                       goto rxh_done;  \
+                       goto rxh_next;  \
        } while (0);
 
+       /*
+        * NB: the rxh_next label works even if we jump
+        *     to it from here because then the list will
+        *     be empty, which is a trivial check
+        */
        CALL_RXH(ieee80211_rx_h_passive_scan)
        CALL_RXH(ieee80211_rx_h_check)
-       CALL_RXH(ieee80211_rx_h_decrypt)
-       CALL_RXH(ieee80211_rx_h_check_more_data)
-       CALL_RXH(ieee80211_rx_h_sta_process)
-       CALL_RXH(ieee80211_rx_h_defragment)
-       CALL_RXH(ieee80211_rx_h_ps_poll)
-       CALL_RXH(ieee80211_rx_h_michael_mic_verify)
-       /* must be after MMIC verify so header is counted in MPDU mic */
-       CALL_RXH(ieee80211_rx_h_remove_qos_control)
-       CALL_RXH(ieee80211_rx_h_amsdu)
+
+       ieee80211_rx_reorder_ampdu(rx, &reorder_release);
+
+       while ((skb = __skb_dequeue(&reorder_release))) {
+               /*
+                * all the other fields are valid across frames
+                * that belong to an aMPDU since they are on the
+                * same TID from the same station
+                */
+               rx->skb = skb;
+
+               CALL_RXH(ieee80211_rx_h_decrypt)
+               CALL_RXH(ieee80211_rx_h_check_more_data)
+               CALL_RXH(ieee80211_rx_h_sta_process)
+               CALL_RXH(ieee80211_rx_h_defragment)
+               CALL_RXH(ieee80211_rx_h_ps_poll)
+               CALL_RXH(ieee80211_rx_h_michael_mic_verify)
+               /* must be after MMIC verify so header is counted in MPDU mic */
+               CALL_RXH(ieee80211_rx_h_remove_qos_control)
+               CALL_RXH(ieee80211_rx_h_amsdu)
 #ifdef CONFIG_MAC80211_MESH
-       if (ieee80211_vif_is_mesh(&sdata->vif))
-               CALL_RXH(ieee80211_rx_h_mesh_fwding);
+               if (ieee80211_vif_is_mesh(&sdata->vif))
+                       CALL_RXH(ieee80211_rx_h_mesh_fwding);
 #endif
-       CALL_RXH(ieee80211_rx_h_data)
-       CALL_RXH(ieee80211_rx_h_ctrl)
-       CALL_RXH(ieee80211_rx_h_action)
-       CALL_RXH(ieee80211_rx_h_mgmt)
+               CALL_RXH(ieee80211_rx_h_data)
+
+               /* special treatment -- needs the queue */
+               res = ieee80211_rx_h_ctrl(rx, &reorder_release);
+               if (res != RX_CONTINUE)
+                       goto rxh_next;
+
+               CALL_RXH(ieee80211_rx_h_action)
+               CALL_RXH(ieee80211_rx_h_mgmt)
 
 #undef CALL_RXH
 
- rxh_done:
-       switch (res) {
-       case RX_DROP_MONITOR:
-               I802_DEBUG_INC(sdata->local->rx_handlers_drop);
-               if (rx->sta)
-                       rx->sta->rx_dropped++;
-               /* fall through */
-       case RX_CONTINUE:
-               ieee80211_rx_cooked_monitor(rx, rate);
-               break;
-       case RX_DROP_UNUSABLE:
-               I802_DEBUG_INC(sdata->local->rx_handlers_drop);
-               if (rx->sta)
-                       rx->sta->rx_dropped++;
-               dev_kfree_skb(rx->skb);
-               break;
-       case RX_QUEUED:
-               I802_DEBUG_INC(sdata->local->rx_handlers_queued);
-               break;
+ rxh_next:
+               switch (res) {
+               case RX_DROP_MONITOR:
+                       I802_DEBUG_INC(sdata->local->rx_handlers_drop);
+                       if (rx->sta)
+                               rx->sta->rx_dropped++;
+                       /* fall through */
+               case RX_CONTINUE:
+                       ieee80211_rx_cooked_monitor(rx, rate);
+                       break;
+               case RX_DROP_UNUSABLE:
+                       I802_DEBUG_INC(sdata->local->rx_handlers_drop);
+                       if (rx->sta)
+                               rx->sta->rx_dropped++;
+                       dev_kfree_skb(rx->skb);
+                       break;
+               case RX_QUEUED:
+                       I802_DEBUG_INC(sdata->local->rx_handlers_queued);
+                       break;
+               }
        }
 }
 
@@ -2187,233 +2449,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                dev_kfree_skb(skb);
 }
 
-#define SEQ_MODULO 0x1000
-#define SEQ_MASK   0xfff
-
-static inline int seq_less(u16 sq1, u16 sq2)
-{
-       return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
-}
-
-static inline u16 seq_inc(u16 sq)
-{
-       return (sq + 1) & SEQ_MASK;
-}
-
-static inline u16 seq_sub(u16 sq1, u16 sq2)
-{
-       return (sq1 - sq2) & SEQ_MASK;
-}
-
-
-static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
-                                           struct tid_ampdu_rx *tid_agg_rx,
-                                           int index)
-{
-       struct ieee80211_supported_band *sband;
-       struct ieee80211_rate *rate = NULL;
-       struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
-       struct ieee80211_rx_status *status;
-
-       if (!skb)
-               goto no_frame;
-
-       status = IEEE80211_SKB_RXCB(skb);
-
-       /* release the reordered frames to stack */
-       sband = hw->wiphy->bands[status->band];
-       if (!(status->flag & RX_FLAG_HT))
-               rate = &sband->bitrates[status->rate_idx];
-       __ieee80211_rx_handle_packet(hw, skb, rate);
-       tid_agg_rx->stored_mpdu_num--;
-       tid_agg_rx->reorder_buf[index] = NULL;
-
-no_frame:
-       tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
-}
-
-static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
-                                            struct tid_ampdu_rx *tid_agg_rx,
-                                            u16 head_seq_num)
-{
-       int index;
-
-       while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
-               index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
-                                                       tid_agg_rx->buf_size;
-               ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
-       }
-}
-
-/*
- * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
- * the skb was added to the buffer longer than this time ago, the earlier
- * frames that have not yet been received are assumed to be lost and the skb
- * can be released for processing. This may also release other skb's from the
- * reorder buffer if there are no additional gaps between the frames.
- */
-#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
-
-/*
- * As this function belongs to the RX path it must be under
- * rcu_read_lock protection. It returns false if the frame
- * can be processed immediately, true if it was consumed.
- */
-static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
-                                            struct tid_ampdu_rx *tid_agg_rx,
-                                            struct sk_buff *skb)
-{
-       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-       u16 sc = le16_to_cpu(hdr->seq_ctrl);
-       u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
-       u16 head_seq_num, buf_size;
-       int index;
-
-       buf_size = tid_agg_rx->buf_size;
-       head_seq_num = tid_agg_rx->head_seq_num;
-
-       /* frame with out of date sequence number */
-       if (seq_less(mpdu_seq_num, head_seq_num)) {
-               dev_kfree_skb(skb);
-               return true;
-       }
-
-       /*
-        * If frame the sequence number exceeds our buffering window
-        * size release some previous frames to make room for this one.
-        */
-       if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
-               head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
-               /* release stored frames up to new head to stack */
-               ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num);
-       }
-
-       /* Now the new frame is always in the range of the reordering buffer */
-
-       index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
-
-       /* check if we already stored this frame */
-       if (tid_agg_rx->reorder_buf[index]) {
-               dev_kfree_skb(skb);
-               return true;
-       }
-
-       /*
-        * If the current MPDU is in the right order and nothing else
-        * is stored we can process it directly, no need to buffer it.
-        */
-       if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
-           tid_agg_rx->stored_mpdu_num == 0) {
-               tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
-               return false;
-       }
-
-       /* put the frame in the reordering buffer */
-       tid_agg_rx->reorder_buf[index] = skb;
-       tid_agg_rx->reorder_time[index] = jiffies;
-       tid_agg_rx->stored_mpdu_num++;
-       /* release the buffer until next missing frame */
-       index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
-                                               tid_agg_rx->buf_size;
-       if (!tid_agg_rx->reorder_buf[index] &&
-           tid_agg_rx->stored_mpdu_num > 1) {
-               /*
-                * No buffers ready to be released, but check whether any
-                * frames in the reorder buffer have timed out.
-                */
-               int j;
-               int skipped = 1;
-               for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
-                    j = (j + 1) % tid_agg_rx->buf_size) {
-                       if (!tid_agg_rx->reorder_buf[j]) {
-                               skipped++;
-                               continue;
-                       }
-                       if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
-                                       HT_RX_REORDER_BUF_TIMEOUT))
-                               break;
-
-#ifdef CONFIG_MAC80211_HT_DEBUG
-                       if (net_ratelimit())
-                               printk(KERN_DEBUG "%s: release an RX reorder "
-                                      "frame due to timeout on earlier "
-                                      "frames\n",
-                                      wiphy_name(hw->wiphy));
-#endif
-                       ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
-
-                       /*
-                        * Increment the head seq# also for the skipped slots.
-                        */
-                       tid_agg_rx->head_seq_num =
-                               (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
-                       skipped = 0;
-               }
-       } else while (tid_agg_rx->reorder_buf[index]) {
-               ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
-               index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
-                                                       tid_agg_rx->buf_size;
-       }
-
-       return true;
-}
-
-/*
- * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
- * true if the MPDU was buffered, false if it should be processed.
- */
-static bool ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
-                                      struct sk_buff *skb)
-{
-       struct ieee80211_hw *hw = &local->hw;
-       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-       struct sta_info *sta;
-       struct tid_ampdu_rx *tid_agg_rx;
-       u16 sc;
-       int tid;
-
-       if (!ieee80211_is_data_qos(hdr->frame_control))
-               return false;
-
-       /*
-        * filter the QoS data rx stream according to
-        * STA/TID and check if this STA/TID is on aggregation
-        */
-
-       sta = sta_info_get(local, hdr->addr2);
-       if (!sta)
-               return false;
-
-       tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
-
-       if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
-               return false;
-
-       tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
-
-       /* qos null data frames are excluded */
-       if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
-               return false;
-
-       /* new, potentially un-ordered, ampdu frame - process it */
-
-       /* reset session timer */
-       if (tid_agg_rx->timeout)
-               mod_timer(&tid_agg_rx->session_timer,
-                         TU_TO_EXP_TIME(tid_agg_rx->timeout));
-
-       /* if this mpdu is fragmented - terminate rx aggregation session */
-       sc = le16_to_cpu(hdr->seq_ctrl);
-       if (sc & IEEE80211_SCTL_FRAG) {
-               ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
-                       tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
-               dev_kfree_skb(skb);
-               return true;
-       }
-
-       return ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb);
-}
-
 /*
  * This is the receive path handler. It is called by a low level driver when an
  * 802.11 MPDU is received from the hardware.
@@ -2495,20 +2530,7 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
                return;
        }
 
-       /*
-        * In theory, the block ack reordering should happen after duplicate
-        * removal (ieee80211_rx_h_check(), which is an RX handler). As such,
-        * the call to ieee80211_rx_reorder_ampdu() should really be moved to
-        * happen as a new RX handler between ieee80211_rx_h_check and
-        * ieee80211_rx_h_decrypt. This cleanup may eventually happen, but for
-        * the time being, the call can be here since RX reorder buf processing
-        * will implicitly skip duplicates. We could, in theory at least,
-        * process frames that ieee80211_rx_h_passive_scan would drop (e.g.,
-        * frames from other than operational channel), but that should not
-        * happen in normal networks.
-        */
-       if (!ieee80211_rx_reorder_ampdu(local, skb))
-               __ieee80211_rx_handle_packet(hw, skb, rate);
+       __ieee80211_rx_handle_packet(hw, skb, rate);
 
        rcu_read_unlock();