> -----Original Message----- > From: Felix Fietkau [mailto:nbd@xxxxxxxx] > Sent: Monday, August 16, 2021 8:23 PM > To: Pkshih; johannes@xxxxxxxxxxxxxxxx > Cc: linux-wireless@xxxxxxxxxxxxxxx; Gary Chang > Subject: Re: [PATCH 1/2] mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug > > On 2021-08-16 10:51, Ping-Ke Shih wrote: > > From: Chih-Kang Chang <gary.chang@xxxxxxxxxxx> > > > > In ieee80211_amsdu_aggregate() set a pointer frag_tail point to the > > end of skb_shinfo(head)->frag_list, and use it to bind other skb in > > the end of this function. But when execute ieee80211_amsdu_aggregate() > > ->ieee80211_amsdu_realloc_pad()->pskb_expand_head(), the address of > > skb_shinfo(head)->frag_list will be changed. However, the > > ieee80211_amsdu_aggregate() not update frag_tail after call > > pskb_expand_head(). That will cause the second skb can't bind to the > > head skb appropriately.So we update the address of frag_tail to fix it. > I think instead of iterating over fragments a second time, we should > move the ieee80211_amsdu_prepare_head call further up. > The first iteration is used to calculate 'n' and 'nfrags' to decide if we need to do AMSDU as well as ieee80211_amsdu_prepare_head(), so we don't have a good idea to move the function upward. However, we have an alternative idea [1] to fix frag_tail. [1] https://lore.kernel.org/linux-wireless/20210830061728.10332-1-pkshih@xxxxxxxxxxx/T/#u -- Ping-Ke
