[PATCH] ap: skip untagged STA VLAN binding for MLO stations

[Jouni Malinen]

On Sat, Sep 26, 2026 at 03:39:44PM +0000, hc86862997 at gmail.com wrote:
> hostapd's dynamic-VLAN-for-MLO support sends SET_STATION with
> NL80211_ATTR_STA_VLAN (plus the MLD link id) for MLO stations even when
> no VLAN is configured (vlan_id == 0), and the bind is deliberately not
> skipped for vlan_id == old_vlanid == 0 (the "needs rebind after
> sta_remove" path in ap_sta_bind_vlan_helper()).
> 
> On kernels without ML VLAN support (no CFG80211_STA_AP_ML_STA;
> mac80211/cfg80211 reject VLAN operations for ML stations) the kernel
> answers -EINVAL, and every rebind - triggered by association and by
> each rekey/EAPOL reauth - fails association processing and tears the
> MLO client down:
> 
> hostapd: nl80211: NL80211_ATTR_STA_VLAN (addr=<sta> ifname=ap-mld1
> vlan_id=0) failed: -22 (Invalid argument)
> 
> Observed as a Wi-Fi 7 MLO client being kicked off an ap-mld interface
> every ~60-90 seconds, deterministically, on MT7996 AP hardware (hostapd
> 831364bf, kernel 6.18.53 / backports 7.2).
> 
> These two guards skip the driver call for untagged MLO stations only;
> dynamic VLAN keeps its previous behaviour until the kernel side gains
> ML VLAN support:
> 
> 1. src/ap/sta_info.c - skip the helper-level bind for MLO stations with
>    vlan_id == 0 (covers the normal association path).
> 2. src/drivers/driver_nl80211.c - funnel guard in i802_set_sta_vlan():
>    skip any untagged (vlan_id == 0) bind that carries a link id, which
>    covers every caller by construction.
> 
> With this applied, zero STA_VLAN errors across many MLO associations
> and rekeys, and the client stays connected; legacy clients on non-MLD
> interfaces and dynamic-VLAN users behave exactly as before. (Also
> reported to OpenWrt, which carries the patch:
> https://github.com/openwrt/openwrt/issues/25415 )
> 
> ---

Please read the top level CONTRIBUTIONS file. I would need a
Signed-off-by: line from the author or copyright holder of the patch to
be able to consider applying it to hostap.git.

> --- a/src/ap/sta_info.c
> +++ b/src/ap/sta_info.c
> @@ -1493,6 +1493,19 @@
> +	/*
> +	 * The kernel side used in this build rejects VLAN operations for
> +	 * MLO stations with -EINVAL (see the driver_nl80211.c part of this
> +	 * patch), and the error makes ap_sta_bind_vlan() fail association

This comment should not reference "this patch" since that context is
quite unclear once the code is applied. Furthermore, sta_info.c should
not have any nl80211 specific behavior or comments since this is
supposed to be independent of the driver interface.

> +	/*
> +	 * Every STA VLAN binding funnels through here.  On an MLD AP each
> +	 * command carries NL80211_ATTR_MLO_LINK_ID, and the kernel side
> +	 * used in this build (no ML VLAN support) rejects such untagged

What is "this build" referring to? That sounds quite unclear and most
likely incorrect for many cases.

> +	 * binds with -EINVAL, which hostapd turns into a station teardown.
> +	 * vlan_id 0 carries no VLAN semantics, so skip the command whenever
> +	 * a link id is present; the station stays bound to its own BSS
> +	 * interface as intended.  Dynamic VLAN (vlan_id > 0) keeps its
> +	 * previous behaviour.
> +	 */
> +	if (vlan_id == 0 && link_id != NL80211_DRV_LINK_ID_NA)
> +		return 0;

Where is the dynamic VLAN case handled for ML associations if this place
skips it?

-- 
Jouni Malinen                                            PGP id EFC895FA