From e035900ffe9e8978f7c0d7b61811b6b578751697 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Mon, 3 Aug 2026 16:08:37 +0200 Subject: [PATCH] wifi: mac80211: fix IEEE80211_TX_CTL_REQ_TX_STATUS mixup In ieee80211_build_hdr(), IEEE80211_TX_CTL_REQ_TX_STATUS is checked in ctrl_flags, which is wrong - IEEE80211_TX_CTL_REQ_TX_STATUS is in info->flags, so the check is for IEEE80211_TX_CTRL_PORT_CTRL_PROTO instead. This works out OK because the only place setting _that_ at a point before this gets called is in fact ieee80211_tx_control_port() which was intended here. This is actually needed for correctness, if jt were checking info->flags instead, TDLS would fill/leak the status frames created here. However, we can just fix it by using the cookie instead, that'll be set for PREAUTH frames via ieee80211_tx_control_port() as well, and no other frames. Additionally, the code also erroneously set it, but that just caused preauth frames to get it set, since storing the ACK SKB will also set the correct flag. Drop this assignment entirely. Fixes: a7528198add8 ("mac80211: support control port TX status reporting") Link: https://patch.msgid.link/20260803141309.292711-10-johannes@sipsolutions.net Signed-off-by: Johannes Berg --- net/mac80211/tx.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 8bfc99958927..5891e1a8d71c 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -2979,8 +2979,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata, } if (unlikely(!multicast && - (sk_requests_wifi_status(skb->sk) || - ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS))) + (sk_requests_wifi_status(skb->sk) || cookie))) info_id = ieee80211_store_ack_skb(local, skb, &info_flags, cookie); @@ -6608,9 +6607,6 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev, if (unencrypted) flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; - if (cookie) - ctrl_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS; - flags |= IEEE80211_TX_INTFL_NL80211_FRAME_TX; skb = dev_alloc_skb(local->hw.extra_tx_headroom +