[PATCH wireless-next] wifi: mac80211: Fix ADDBA request rejection after MLD link removal

[Manish Dharanenthiran <manish.dharanenthiran@oss.qualcomm.com>]

From: Hari Naraayana Desikan Kannan <hnaraaya@qti.qualcomm.com>

Subsequent ADDBA requests from a non-AP MLD can be rejected with status
0x0025 (Request declined), preventing BA establishment. This happens
because mac80211 checks the per-TID A-MPDU session's tid_rx pointer to
detect timeout changes on ADDBA updates. For drivers that set
SUPPORT_REORDERING_BUFFER, the reordering state is owned by the driver
and tid_rx will be NULL, causing mac80211 to incorrectly decline the
update.

This can occur during MLO link reconfiguration, where a non-AP MLD may
remove one of its links while a Block Ack (BA) session is active. After
the link is removed, ADDBA update requests sent on the remaining links
are rejected, preventing BA establishment.

Fix this by calling drv_ampdu_action() on ADDBA updates when
SUPPORT_REORDERING_BUFFER is set, so the driver can accept or reject the
update based on its capabilities and allow BA to be established on the
remaining links.

Signed-off-by: Hari Naraayana Desikan Kannan <hnaraaya@qti.qualcomm.com>
Signed-off-by: Manish Dharanenthiran <manish.dharanenthiran@oss.qualcomm.com>
---
Note: A similar fix has been proposed in [1]. This patch also fixes the
issue mentioned there. The difference in approach is to keep a similar
flow when the dialog_token matches. Previously only the timeout value
is checked, updated that to check the timeout only for the hardware that
doesn't set SUPPORT_REORDERING_BUFFER. In [1], it was changed to invoke
driver unconditionally when SUPPORT_REORDERING_BUFFER is set.

https://lore.kernel.org/all/5806bab7e46506d3c300ab4eb66989d42936aeb0.1771323902.git.repk@triplefau.lt/
---
 net/mac80211/agg-rx.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 0140ac826b23..20c849f7930e 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -376,6 +376,23 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
 			ht_dbg_ratelimited(sta->sdata,
 					   "updated AddBA Req from %pM on tid %u\n",
 					   sta->sta.addr, tid);
+			/*
+			 * For drivers with SUPPORTS_REORDERING_BUFFER set, let
+			 * the driver handle the BA update, as it manages the BA
+			 * state.
+			 */
+			if (ieee80211_hw_check(&local->hw,
+					       SUPPORTS_REORDERING_BUFFER)) {
+				ret = drv_ampdu_action(local, sta->sdata,
+						       &params);
+				ht_dbg_ratelimited(sta->sdata,
+						   "Updated AddBA Req result %d\n",
+						   ret);
+				if (!ret)
+					status = WLAN_STATUS_SUCCESS;
+				goto end;
+			}
+
 			/* We have no API to update the timeout value in the
 			 * driver so reject the timeout update if the timeout
 			 * changed. If it did not change, i.e., no real update,

---
base-commit: dbd94b9831bc52a1efb7ff3de841ffc3457428ce
change-id: 20260330-addba-req-0673c746c9d5