[PATCH] mac80211: fix paged defragmentation

[PATCH] mac80211: fix paged defragmentation

[Abhijeet Kolekar]

Fix the bug at
http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2194

Paged RX skb patch broke the fragmentation while checking the sequnce
control bit in headers. Instead of doing linearization of all the frames
to check seq_ctrl bit just copy the bits.

Signed-off-by: Abhijeet Kolekar <abhijeet.kolekar@intel.com>
---
 net/mac80211/rx.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 72efbd8..4126392 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1234,14 +1234,16 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
 {
 	struct ieee80211_hdr *hdr;
 	u16 sc;
-	__le16 fc;
+	__le16 fc, seq_ctrl;
 	unsigned int frag, seq;
 	struct ieee80211_fragment_entry *entry;
 	struct sk_buff *skb;
 
 	hdr = (struct ieee80211_hdr *)rx->skb->data;
 	fc = hdr->frame_control;
-	sc = le16_to_cpu(hdr->seq_ctrl);
+	skb_copy_bits(rx->skb, offsetof(struct ieee80211_hdr, seq_ctrl),
+			&seq_ctrl, sizeof(seq_ctrl));
+	sc = le16_to_cpu(seq_ctrl);
 	frag = sc & IEEE80211_SCTL_FRAG;
 
 	if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
-- 
1.6.3.3

Re: [PATCH] mac80211: fix paged defragmentation

[Johannes Berg]

On Wed, 2010-04-28 at 13:59 -0700, Abhijeet Kolekar wrote:
> Fix the bug at
> http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2194
> 
> Paged RX skb patch broke the fragmentation while checking the sequnce
> control bit in headers. Instead of doing linearization of all the frames
> to check seq_ctrl bit just copy the bits.

Just FYI, we're discussing this patch still and Zhu Yi found that most
likely this won't actually fix it since the seq_ctrl should already be
part of the linear data. Instead the real problem seems to be a missing
reload of the hdr variable after linearizing.

johannes