[PATCH] nl80211: Ignore the link ID of spurious frames on a non-MLD

[Jouni Malinen]

On Thu, Oct 08, 2026 at 02:55:50PM +0300, Andrei Otcheretianski wrote:
> mac80211 normalizes the link ID of the default link to 0, so the kernel
> reports NL80211_ATTR_MLO_LINK_ID = 0 in NL80211_CMD_UNEXPECTED_FRAME and
> NL80211_CMD_UNEXPECTED_4ADDR_FRAME events even for an AP that is not an
> MLD. Such a BSS has no valid links, so the link validation rejected
> every one of these events and hostapd stopped reacting to Class 3 frames
> received from unassociated stations and to unexpected 4-address frames.

Why would mac80211 do that for non-MLO cases? That attribute is
explicitly named and documented to apply for MLO. Using it for non-MLO
cases sounds like a bug in mac80211.

> This broke the hwsim tests that depend on these events: ap_open_ifdown,
> ap_pmf_ap_dropping_sa and hapd_ctrl_disconnect_no_tx, where the station
> is no longer deauthenticated or disassociated, and ap_wds_sta,
> ap_wds_sta_eap, ap_wds_sta_open and ap_wds_sta_wep, where the 4-address
> WDS interface is never set up.
> 
> Skip the link handling altogether when the BSS is not an MLD.

Is that "this broke" implying that mac80211 behavior changed recently?
If so, I would fix that in mac80211 instead of trying to work around
this in user space.

> Fixes: 44d144d60364 ("nl80211: Handle WDS events on appropriate link in AP MLD")

This does not really fix that commit.. This adds a workaround for
unexpected kernel behavior. If that kernel behavior has been in use for
a while, I could understand this hostap.git change as a workaround, but
the commit message should be clear on that being the case instead of
this being a fix for a bug in user space.

> diff --git a/src/drivers/driver_nl80211_event.c b/src/drivers/driver_nl80211_event.c
> @@ -2878,7 +2878,13 @@ static void nl80211_spurious_frame(struct i802_bss *bss, struct nlattr **tb,
> -	if (link_id >= 0) {
> +	/*
> +	 * The kernel reports link ID 0 for the default link, so the link is
> +	 * relevant only when this BSS is actually an MLD.

That comment is also implying that this is normal and expected kernel
behavior which is not really what this looks to me.

-- 
Jouni Malinen                                            PGP id EFC895FA