--- /dev/null
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 4 Nov 2016 10:18:51 +0100
+Subject: [PATCH] mac80211: fix A-MSDU aggregation with fast-xmit + txq
+
+A-MSDU aggregation alters the QoS header after a frame has been
+enqueued, so it needs to be ready before enqueue and not overwritten
+again afterwards
+
+Fixes: bb42f2d13ffc ("mac80211: Move reorder-sensitive TX handlers to after TXQ dequeue")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -3245,7 +3245,6 @@ static void ieee80211_xmit_fast_finish(s
+
+ if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
+ tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
+- *ieee80211_get_qos_ctl(hdr) = tid;
+ hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
+ } else {
+ info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
+@@ -3370,6 +3369,11 @@ static bool ieee80211_xmit_fast(struct i
+ (tid_tx ? IEEE80211_TX_CTL_AMPDU : 0);
+ info->control.flags = IEEE80211_TX_CTRL_FAST_XMIT;
+
++ if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
++ tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
++ *ieee80211_get_qos_ctl(hdr) = tid;
++ }
++
+ __skb_queue_head_init(&tx.skbs);
+
+ tx.flags = IEEE80211_TX_UNICAST;