Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH 1/2] mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
To:     Ping-Ke Shih <pkshih@realtek.com>, johannes@sipsolutions.net
Cc:     linux-wireless@vger.kernel.org, gary.chang@realtek.com
References: <20210816085128.10931-1-pkshih@realtek.com>
From:   Felix Fietkau <nbd@nbd.name>
Message-ID: <1a7bdf33-046a-b67b-f650-7b4c3d7e2859@nbd.name>
Date:   Mon, 16 Aug 2021 14:22:30 +0200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0)
 Gecko/20100101 Thunderbird/78.13.0
MIME-Version: 1.0
In-Reply-To: <20210816085128.10931-1-pkshih@realtek.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 2021-08-16 10:51, Ping-Ke Shih wrote:
> From: Chih-Kang Chang <gary.chang@realtek.com>
> 
> In ieee80211_amsdu_aggregate() set a pointer frag_tail point to the
> end of skb_shinfo(head)->frag_list, and use it to bind other skb in
> the end of this function. But when execute ieee80211_amsdu_aggregate()
> ->ieee80211_amsdu_realloc_pad()->pskb_expand_head(), the address of
> skb_shinfo(head)->frag_list will be changed. However, the
> ieee80211_amsdu_aggregate() not update frag_tail after call
> pskb_expand_head(). That will cause the second skb can't bind to the
> head skb appropriately.So we update the address of frag_tail to fix it.
I think instead of iterating over fragments a second time, we should
move the ieee80211_amsdu_prepare_head call further up.

- Felix