+++ /dev/null
-From 44271488b91c9eecf249e075a1805dd887e222d2 Mon Sep 17 00:00:00 2001
-From: Johannes Berg <johannes.berg@intel.com>
-Date: Tue, 5 Oct 2010 21:40:33 +0200
-Subject: mac80211: delete AddBA response timer
-
-From: Johannes Berg <johannes.berg@intel.com>
-
-commit 44271488b91c9eecf249e075a1805dd887e222d2 upstream.
-
-We never delete the addBA response timer, which
-is typically fine, but if the station it belongs
-to is deleted very quickly after starting the BA
-session, before the peer had a chance to reply,
-the timer may fire after the station struct has
-been freed already. Therefore, we need to delete
-the timer in a suitable spot -- best when the
-session is being stopped (which will happen even
-then) in which case the delete will be a no-op
-most of the time.
-
-I've reproduced the scenario and tested the fix.
-
-This fixes the crash reported at
-http://mid.gmane.org/4CAB6F96.6090701@candelatech.com
-
-Reported-by: Ben Greear <greearb@candelatech.com>
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
-Signed-off-by: John W. Linville <linville@tuxdriver.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- net/mac80211/agg-tx.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/net/mac80211/agg-tx.c
-+++ b/net/mac80211/agg-tx.c
-@@ -177,6 +177,8 @@ int ___ieee80211_stop_tx_ba_session(stru
-
- del_timer_sync(&tid_tx->addba_resp_timer);
-
-+ del_timer_sync(&tid_tx->addba_resp_timer);
-+
- /*
- * After this packets are no longer handed right through
- * to the driver but are put onto tid_tx->pending instead,
mac80211-reset-probe-send-counter-upon-connection-timer-reset.patch
mac80211-fix-ibss-station-got-expired-immediately.patch
mac80211-don-t-sanitize-invalid-rates.patch
-mac80211-delete-addba-response-timer.patch
isdn-gigaset-fix-bas_gigaset-at-read-error-handling.patch
isdn-gigaset-correct-bas_gigaset-rx-buffer-handling.patch
isdn-gigaset-bas_gigaset-locking-fix.patch