wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn

[ Upstream commit 422850b29e05e67c9145895bfe559940caa0caa8 ]

If no frames are received on a queue for a while, the reorder buffer
head_sn may be an old one. When the next frame that is received on
that queue and buffered is a subframe of an AMSDU but not the last
subframe, it will not update the buffer's head_sn. When the frame
release notification arrives, it will not release the buffered frame
because it will look like the notification's NSSN is lower than the
buffer's head_sn (because of a wraparound).
Fix it by updating the head_sn when the first frame is buffered.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Reviewed-by: Daniel Gabay <daniel.gabay@intel.com>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20250723094230.795ec0cb8817.I9ec9a3508e7935e8d1833ea3e086066fdefee644@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 077aadbf95db55e6589ec82ca4b132833e085c95..e0f87ebefc18af503595966aa2fd99e50943da67 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -854,10 +854,15 @@ static bool iwl_mvm_reorder(struct iwl_mvm *mvm,
         * already ahead and it will be dropped.
         * If the last sub-frame is not on this queue - we will get frame
         * release notification with up to date NSSN.
+        * If this is the first frame that is stored in the buffer, the head_sn
+        * may be outdated. Update it based on the last NSSN to make sure it
+        * will be released when the frame release notification arrives.
         */
        if (!amsdu || last_subframe)
                iwl_mvm_release_frames(mvm, sta, napi, baid_data,
                                       buffer, nssn);
+       else if (buffer->num_stored == 1)
+               buffer->head_sn = nssn;
 
        spin_unlock_bh(&buffer->lock);
        return true;