[PATCH 0/3] AP: Do not lose a STA whose (Re)Association Response ACK was lost

Andrei-Alexandru Bleortu me at andrei-z.com
Fri Oct 16 16:55:32 PDT 2026


On an ath11k AP (IPQ5018 + QCN9074) about 0.5% of the Reassociation
Response frames of FT roams were reported as not acknowledged although the
STA had received them (the firmware tries at most four times). hostapd
then removed the STA; the STA's first data frame drew an unprotected
Deauthentication frame that a PMF STA drops, and the STA stalled in SA
Queries the AP could not answer, for about 4.5 seconds, before it
connected again.

2 completes such an association when the STA's first Class 3 frame
arrives, and 3 tests it by reporting the TX status of the Reassociation
Response frame as not acknowledged. 1 fixes what kept hostapd from seeing
those frames at all: since commit 44d144d60 every unexpected frame event
of a non-MLD AP is dropped, because mac80211 includes link ID 0 in it.
That also broke ap_wds_sta, ap_wds_sta_open, ap_wds_sta_wep and
ap_wds_sta_eap, which pass again with 1.

The hwsim test fails without 1 and 2 and passes with them; ap_ft, ap_pmf,
ap_open, ap_psk, sae, fils, ap_vlan, ap_params, ap_roam and multi_ap pass
(661 tests).

Andrei-Alexandru Bleortu (3):
  nl80211: Do not take link ID 0 of a non-MLD BSS as an MLD link
  AP: Complete an association whose response ACK was lost
  tests: FT with PMF and the Reassociation Response frame not
    acknowledged

 src/ap/ieee802_11.c                | 41 ++++++++++++++++++++++++
 src/ap/sta_info.c                  |  5 +++
 src/ap/sta_info.h                  |  3 ++
 src/drivers/driver_nl80211_event.c |  4 +++
 tests/hwsim/test_ap_ft.py          | 50 ++++++++++++++++++++++++++++++
 5 files changed, 103 insertions(+)

-- 
2.47.3





More information about the Hostap mailing list