diff options
Diffstat (limited to 'net/mac80211')
| -rw-r--r-- | net/mac80211/tx.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 673ad3cf2c3a..bef517ccdecb 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -3365,6 +3365,14 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata, if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head)) goto out; + /* If n == 2, the "while (*frag_tail)" loop above didn't execute + * and frag_tail should be &skb_shinfo(head)->frag_list. + * However, ieee80211_amsdu_prepare_head() can reallocate it. + * Reload frag_tail to have it pointing to the correct place. + */ + if (n == 2) + frag_tail = &skb_shinfo(head)->frag_list; + /* * Pad out the previous subframe to a multiple of 4 by adding the * padding to the next one, that's being added. Note that head->len |