From: Chih-Kang Chang <gary.chang@xxxxxxxxxxx>
In ieee80211_amsdu_aggregate() set a pointer frag_tail point to the
end of skb_shinfo(head)->frag_list, and use it to bind other skb in
the end of this function. But when execute ieee80211_amsdu_aggregate()
->ieee80211_amsdu_realloc_pad()->pskb_expand_head(), the address of
skb_shinfo(head)->frag_list will be changed. However, the
ieee80211_amsdu_aggregate() not update frag_tail after call
pskb_expand_head(). That will cause the second skb can't bind to the
head skb appropriately.So we update the address of frag_tail to fix it.
Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
Signed-off-by: Chih-Kang Chang <gary.chang@xxxxxxxxxxx>
Signed-off-by: Ping-Ke Shih <pkshih@xxxxxxxxxxx>
---
net/mac80211/tx.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8509778ff31f..9e0d4fca1c76 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3406,6 +3406,12 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
head->len += skb->len;
head->data_len += skb->len;
+
+ /* frag_list should be updated after pskb_expand_head() */
+ frag_tail = &skb_shinfo(head)->frag_list;
+ while (*frag_tail)
+ frag_tail = &(*frag_tail)->next;
+
*frag_tail = skb;
out_recalc:
--
2.25.1
