[PATCH AUTOSEL 6.14 082/108] wifi: ath12k: correctly handle mcast packets for clients

Tue Jun 3 17:55:05 PDT 2025

From: Sarika Sharma <quic_sarishar at quicinc.com>

[ Upstream commit 4541b0c8c3c1b85564971d497224e57cf8076a02 ]

Currently, RX is_mcbc bit is set for packets sent from client as
destination address (DA) is multicast/broadcast address, but packets
are actually unicast as receiver address (RA) is not multicast address.
Hence, packets are not handled properly due to this is_mcbc bit.

Therefore, reset the is_mcbc bit if interface type is AP.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1

Signed-off-by: Sarika Sharma <quic_sarishar at quicinc.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan at oss.qualcomm.com>
Link: https://patch.msgid.link/20250411061523.859387-3-quic_sarishar@quicinc.com
Signed-off-by: Jeff Johnson <jeff.johnson at oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal at kernel.org>
---

**YES** This commit should be backported to stable kernel trees. Here's
my extensive analysis: ## Bug Analysis **Root Cause**: The commit fixes
a critical packet handling issue where multicast/broadcast packets from
clients to an AP are incorrectly marked as multicast (is_mcbc=true)
based on the destination address (DA) being multicast, even though they
are actually unicast packets since the receiver address (RA) is not
multicast. **Impact**: This causes legitimate unicast packets to be
mishandled, potentially leading to: - Incorrect encryption handling
(using group keys instead of unicast keys) - Packet drops or processing
errors - Connectivity issues for clients connected to AP ## Code Changes
Analysis The fix involves three key changes: 1. **New peer field
(`peer.h:65`)**: Adds `bool ucast_ra_only` field to track when a peer
should only receive unicast packets 2. **Peer initialization
(`peer.c:386-387`)**: Sets `peer->ucast_ra_only = true` for AP interface
types, indicating that packets to/from AP clients should be treated as
unicast 3. **Runtime correction (`dp_rx.c:2328-2331`)**: Adds logic to
reset the is_mcbc bit when a peer has `ucast_ra_only=true`: ```c /bin
/bin.usr-is-merged /boot /dev /etc /home /init /lib /lib.usr-is-merged
/lib64 /lost+found /media /mnt /opt /proc /root /run /sbin /sbin.usr-is-
merged /snap /srv /sys /tmp /usr /var resetting mcbc bit because mcbc
packets are unicast capability_test capability_test.c
f2fs_folio_analysis.md ipv4_multipath_analysis.md
ipv6_route_allocation_rcu_analysis.md ixgbe_e610_set_phys_id_analysis.md
linux lpfc_timeout_analysis.md mac80211_mlo_mbssid_analysis.md
pfcp_driver_historical_analysis.md rtl_bb_delay_analysis.md
rtw89_mlo_analysis.md tcp_multipath_load_balance_analysis.md
test_unaligned_diff test_unaligned_diff.c type_size_check
type_size_check.c veth_driver_analysis.md
wifi_mlo_mbssid_tx_link_id_analysis.md packets only for AP as STA sends
unicast packets. linux/ rxcb->is_mcbc = rxcb->is_mcbc &&
!peer->ucast_ra_only; ``` ## Backport Suitability Assessment **✅ Fixes
Important Bug**: This addresses a real packet handling issue that
affects AP functionality and client connectivity. **✅ Small and
Contained**: The fix is minimal - adds one field and a simple boolean
logic correction. Total change is ~10 lines. **✅ Low Regression Risk**:
- Only affects AP mode (`NL80211_IFTYPE_AP`) - Uses conservative
approach (resets mcbc bit only when appropriate) - No architectural
changes **✅ Clear Side Effects**: The change is isolated to
multicast/broadcast packet classification logic and doesn't touch other
subsystems. **✅ Subsystem Confined**: Changes are entirely within the
ath12k Wi-Fi driver's receive path. ## Comparison with Similar Commits
This commit closely matches **Similar Commit #1** and **Similar Commit
#3** (both marked YES for backporting): - Fixes multicast/broadcast
packet handling issues in ath12k - Small, targeted fixes with clear bug
descriptions - Hardware-specific corrections for packet classification -
Similar code patterns and impact scope The commit follows the same
pattern as other successful ath12k multicast fixes that were deemed
suitable for stable backporting. ## Conclusion This is a classic stable
tree candidate: it fixes a real user-impacting bug with a minimal, low-
risk change that's confined to a single driver subsystem. The fix
addresses incorrect packet classification that could cause connectivity
issues in AP mode.

 drivers/net/wireless/ath/ath12k/dp_rx.c | 5 +++++
 drivers/net/wireless/ath/ath12k/peer.c  | 5 ++++-
 drivers/net/wireless/ath/ath12k/peer.h  | 3 ++-
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
index ff6a709b5042c..cfa96c6216177 100644
--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -2277,6 +2277,11 @@ static void ath12k_dp_rx_h_mpdu(struct ath12k *ar,
 	spin_lock_bh(&ar->ab->base_lock);
 	peer = ath12k_dp_rx_h_find_peer(ar->ab, msdu);
 	if (peer) {
+		/* resetting mcbc bit because mcbc packets are unicast
+		 * packets only for AP as STA sends unicast packets.
+		 */
+		rxcb->is_mcbc = rxcb->is_mcbc && !peer->ucast_ra_only;
+
 		if (rxcb->is_mcbc)
 			enctype = peer->sec_type_grp;
 		else
diff --git a/drivers/net/wireless/ath/ath12k/peer.c b/drivers/net/wireless/ath/ath12k/peer.c
index 792cca8a3fb1b..ec7236bbccc0f 100644
--- a/drivers/net/wireless/ath/ath12k/peer.c
+++ b/drivers/net/wireless/ath/ath12k/peer.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: BSD-3-Clause-Clear
 /*
  * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2022, 2024-2025 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include "core.h"
@@ -383,6 +383,9 @@ int ath12k_peer_create(struct ath12k *ar, struct ath12k_link_vif *arvif,
 		arvif->ast_idx = peer->hw_peer_id;
 	}
 
+	if (vif->type == NL80211_IFTYPE_AP)
+		peer->ucast_ra_only = true;
+
 	if (sta) {
 		ahsta = ath12k_sta_to_ahsta(sta);
 		arsta = wiphy_dereference(ath12k_ar_to_hw(ar)->wiphy,
diff --git a/drivers/net/wireless/ath/ath12k/peer.h b/drivers/net/wireless/ath/ath12k/peer.h
index 5870ee11a8c7e..f3a5e054d2b55 100644
--- a/drivers/net/wireless/ath/ath12k/peer.h
+++ b/drivers/net/wireless/ath/ath12k/peer.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: BSD-3-Clause-Clear */
 /*
  * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #ifndef ATH12K_PEER_H
@@ -62,6 +62,7 @@ struct ath12k_peer {
 
 	/* for reference to ath12k_link_sta */
 	u8 link_id;
+	bool ucast_ra_only;
 };
 
 struct ath12k_ml_peer {
-- 
2.39.5


