From 8eaf050b723afd66c70d73513e093751816e5336 Mon Sep 17 00:00:00 2001
From: tobhe <tobhe@cvs.openbsd.org>
Date: Wed, 9 Dec 2020 13:24:23 +0000
Subject: Flush reorder buffer after gap timeout, otherwise the frames remain
 in the buffer until the next frame is received.

Found by and fix from Christian Ehrhardt
ok stsp@
---
 sys/net80211/ieee80211_input.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'sys/net80211/ieee80211_input.c')

diff --git a/sys/net80211/ieee80211_input.c b/sys/net80211/ieee80211_input.c
index 81f054a70d7..96250c8036b 100644
--- a/sys/net80211/ieee80211_input.c
+++ b/sys/net80211/ieee80211_input.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211_input.c,v 1.224 2020/12/08 20:17:32 stsp Exp $	*/
+/*	$OpenBSD: ieee80211_input.c,v 1.225 2020/12/09 13:24:22 tobhe Exp $	*/
 
 /*-
  * Copyright (c) 2001 Atsushi Onoe
@@ -959,6 +959,11 @@ ieee80211_input_ba_gap_timeout(void *arg)
 
 	skipped = ieee80211_input_ba_gap_skip(ba);
 	ic->ic_stats.is_ht_rx_ba_frame_lost += skipped;
+	if (skipped) {
+		struct mbuf_list ml = MBUF_LIST_INITIALIZER();
+		ieee80211_input_ba_flush(ic, ni, ba, &ml);
+		if_input(&ic->ic_if, &ml);
+	}
 
 	splx(s);	
 }
-- 
cgit v1.2.3