[PATCH wireless-next v2] wifi: mac80211: Guard FILS discovery and unsolicited broadcast probe response

[PATCH wireless-next v2] wifi: mac80211: Guard FILS discovery and unsolicited broadcast probe response

[Manish Dharanenthiran]

According to IEEE Std 802.11-2024, subclause 11.45.2.1 FILS Discovery
frame transmission, only a transmitting BSS shall transmit a FILS
Discovery frame. Currently, BSS_CHANGED_FILS_DISCOVERY is set
unconditionally for all the BSSs. Hence, add a check to allow setting
the FILS Discovery flag only for a transmitting BSS.

Similarly, IEEE Std 802.11-2024, subclause 26.17.2.3.2 AP behavior for
fast passive scanning, mentions that unsolicited broadcast probe
response frame shall be transmitted only by a transmitting BSS. Hence,
add a check to allow setting the BSS_CHANGED_UNSOL_BCAST_PROBE_RESP only
for a transmitting BSS.

Currently in user-space there is no restriction on sending this for
non-transmitting BSS, thus it may send these for those BSSs as well.
However the driver will use the config only for transmitting BSS and
ignore for non-transmitting BSS. Returning an error here, even if
user-space sets these, could be fatal because failing start_ap or
update_ap operation would result in failure of bringing up those BSSs.
Thus, ignore the config for non-transmitting BSS silently.

Signed-off-by: Manish Dharanenthiran <manish.dharanenthiran@oss.qualcomm.com>
---
Changes in v2:
- Updated commit message to mention why the config is silently ignored,
  instead of error. Also added code comments to mention the same.
- Link to v1: https://patch.msgid.link/20260820-fils-v1-1-56df490f5bb6@oss.qualcomm.com
---
 net/mac80211/cfg.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 23f4f9ec86d0..df9b84b3b30d 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1138,7 +1138,12 @@ static int ieee80211_set_fils_discovery(struct ieee80211_sub_if_data *sdata,
 	struct fils_discovery_data *new, *old = NULL;
 	struct ieee80211_fils_discovery *fd;
 
-	if (!params->update)
+	/*
+	 * Only transmitting BSS should set this config, ignore this config for
+	 * non-transmitting BSS silently even if user-space sets it, as
+	 * returning error would result in failure of bringing up of those BSSs.
+	 */
+	if (!params->update || link_conf->nontransmitted)
 		return 0;
 
 	fd = &link_conf->fils_discovery;
@@ -1173,7 +1178,12 @@ ieee80211_set_unsol_bcast_probe_resp(struct ieee80211_sub_if_data *sdata,
 {
 	struct unsol_bcast_probe_resp_data *new, *old = NULL;
 
-	if (!params->update)
+	/*
+	 * Only transmitting BSS should set this config, ignore this config for
+	 * non-transmitting BSS silently even if user-space sets it, as
+	 * returning error would result in failure of bringing up of those BSSs.
+	 */
+	if (!params->update || link_conf->nontransmitted)
 		return 0;
 
 	link_conf->unsol_bcast_probe_resp_interval = params->interval;

---
base-commit: ca800a9302764c445de0da0e84d2252400a770ee
change-id: 20260817-fils-d17716cc2781

Re: [PATCH wireless-next v2] wifi: mac80211: Guard FILS discovery and unsolicited broadcast probe response

[Johannes Berg]

On Fri, 2026-09-18 at 12:47 +0530, Manish Dharanenthiran wrote:
> 
> Currently in user-space there is no restriction on sending this for
> non-transmitting BSS, thus it may send these for those BSSs as well.
> However the driver will use the config only for transmitting BSS and
> ignore for non-transmitting BSS. Returning an error here, even if
> user-space sets these, could be fatal because failing start_ap or
> update_ap operation would result in failure of bringing up those BSSs.
> Thus, ignore the config for non-transmitting BSS silently.

And honestly, it really _should_ be fatal since it really is a wront
configuration, so that text isn't really that useful, nor the comments:

> +	/*
> +	 * Only transmitting BSS should set this config, ignore this config for
> +	 * non-transmitting BSS silently even if user-space sets it, as
> +	 * returning error would result in failure of bringing up of those BSSs.
> +	 */
> +	if (!params->update || link_conf->nontransmitted)

Please state that currently it actually _is_ (erroneously) being set by
hostapd and we need to keep it working.

johannes

Re: [PATCH wireless-next v2] wifi: mac80211: Guard FILS discovery and unsolicited broadcast probe response

[Manish Dharanenthiran]

On 9/21/2026 2:27 PM, Johannes Berg wrote:
> On Fri, 2026-09-18 at 12:47 +0530, Manish Dharanenthiran wrote:
>>
>> Currently in user-space there is no restriction on sending this for
>> non-transmitting BSS, thus it may send these for those BSSs as well.
>> However the driver will use the config only for transmitting BSS and
>> ignore for non-transmitting BSS. Returning an error here, even if
>> user-space sets these, could be fatal because failing start_ap or
>> update_ap operation would result in failure of bringing up those BSSs.
>> Thus, ignore the config for non-transmitting BSS silently.
> 
> And honestly, it really _should_ be fatal since it really is a wront
> configuration, so that text isn't really that useful, nor the comments:
> 
>> +	/*
>> +	 * Only transmitting BSS should set this config, ignore this config for
>> +	 * non-transmitting BSS silently even if user-space sets it, as
>> +	 * returning error would result in failure of bringing up of those BSSs.
>> +	 */
>> +	if (!params->update || link_conf->nontransmitted)
> 
> Please state that currently it actually _is_ (erroneously) being set by
> hostapd and we need to keep it working.
> 
> johannes

Understood!, will modify the text and the comments in the next version.

-- 
- Manish D