)]}' { "log": [ { "commit": "b072bff87347dd34a05f371d66048c7ab79757af", "tree": "3660fbc78abab5f11b39c3156655eab90c96ce85", "parents": [ "0805bd02aae99f3917455932b3f6a30a2c6296bf" ], "author": { "name": "David Ruth", "email": "druth@chromium.org", "time": "Wed Jul 22 01:37:57 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 04:27:30 2026" }, "message": "UPSTREAM: Fix printf format strings.\n\nVariables of type size_t should be printed with the %z printf format\nspecifier. Variables that represent a difference of pointers should be\nprinted with the %t printf format specifier.\n\nSigned-off-by: David Ruth \u003cdruth@chromium.org\u003e\n(cherry picked from commit 0d91c94ff5ade27ac114918c2107aea9a4f4f5b2)\n\nBUG\u003db:535234033\nTEST\u003dhostap_hwsim and wifi_matfunc\nBranches: N/A\n\nChange-Id: I379e235ed80c55f4c6aa1f1fa66d1c49dffb2701\nSigned-off-by: David Ruth \u003cdruth@google.com\u003e\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/hostap/+/8144262\nReviewed-by: Jintao Lin \u003cjintaolin@chromium.org\u003e\nTested-by: David Ruth \u003cdruth@chromium.org\u003e\nCommit-Queue: David Ruth \u003cdruth@chromium.org\u003e\n" }, { "commit": "0805bd02aae99f3917455932b3f6a30a2c6296bf", "tree": "858ff33ff8f13fa299d19d9bb3fdf794ba787b18", "parents": [ "06d7ba028693f50d25a964ed83dd056d7e995445", "81d9f3598b1b394d20b455db644f7555c98752cf" ], "author": { "name": "David Ruth", "email": "druth@google.com", "time": "Tue Jul 21 07:52:07 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Jul 28 04:27:26 2026" }, "message": "Merge upstream/main into wpa_supplicant-2.10.0\n\nBUG\u003db:535234033\n\nPatchlist is too long for system context.\n\nConflicts:\n* src/ap/ap_config.h, src/drivers/driver.h, src/drivers/driver_common.c change require_eht parameter from an int to a bool to match upstream\n* src/ap/ieee802_11.c mirror upstream as dependent changes for EHT have made their way upstream in slightly different forms\n* src/ap/ieee802_11_eht.c - whitespace conflict and rename EHT_PER_STA_CTRL_LINK_ID_MSK to BASIC_MLE_STA_CTRL_LINK_ID_MASK\n* src/common/ieee802_11_defs.h whitespace conflicts\n* src/drivers/driver_nl80211_event.c process_global_event adopt upstream code, as there were no local changes\n* wpa_supplicant/bss.c match upstream. Allow special paths for WNM and INTERNETWORKING\n* wpa_supplicant/events.c whitespace and bracket changes between upstream and chromiumos. Resolved in favor of upstream. Add poll_current parameter to wpa_supplicant_need_to_roam_within_ess\n* wpa_supplicant/scan.c preserve CHROMIUM special casing\n* wpa_supplicant/wpa_supplicant_i.h fix duplicate variable introduced by different ordering between upstream and chromiumos.\n\nChange-Id: If3d03d8a832549fb48323e1a23ff7fb8e16133f4\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/hostap/+/8130817\nReviewed-by: Jintao Lin \u003cjintaolin@chromium.org\u003e\nTested-by: David Ruth \u003cdruth@chromium.org\u003e\nCommit-Queue: David Ruth \u003cdruth@chromium.org\u003e\n" }, { "commit": "81d9f3598b1b394d20b455db644f7555c98752cf", "tree": "95c9251ec54fd37b4167a3ca168b33a0156f81f6", "parents": [ "c32922c0ada7c2c02e3d9cb3f9a370b9ffc5759c" ], "author": { "name": "Xinyue Ling", "email": "xinyling@qti.qualcomm.com", "time": "Thu Jun 18 07:12:39 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jul 20 21:33:09 2026" }, "message": "MLO: Parse each link profile from a private buffer copy\n\nwpas_parse_connection_info() parsed every MLO link from a single\nshared req_mlbuf/resp_mlbuf in the for_each_link loop. For each\nlink, ieee802_11_parse_link_profile() calls\nieee802_11_defrag_mle_subelem(), which defragments the Multi-Link\nelement subelements in-place using os_memmove() and does not update\nthe wpabuf length.\n\nWhen the first parsed link encountered a fragmented per-STA profile\n(\u003e255 octets), the in-place defragmentation permanently rewrote the\nshared buffer. Subsequent links re-read the buffer from its head\nwith the original (now stale) length, so the subelement boundaries\nwere misaligned and parsing failed with \"sub_elem_len\u003d0 \u003c 5\"\n(ParseFailed). Those links then fell back to copying the association\nlink\u0027s bandwidth, causing, e.g., a 5 GHz link to be reported as\nchannel_width\u003d320 instead of its actual channel width.\n\nFix this by duplicating req_mlbuf/resp_mlbuf per link and parsing\nfrom the private copies, so one link\u0027s in-place defragmentation can\nno longer corrupt the buffer used for the remaining links.\n\nSigned-off-by: Xinyue Ling \u003cxinyling@qti.qualcomm.com\u003e\n" }, { "commit": "c32922c0ada7c2c02e3d9cb3f9a370b9ffc5759c", "tree": "fb9fdd5cb78dea861e06c70258f03e79b728645e", "parents": [ "3b201c4864162d78ccc6dd8a61573ff7eff4dccd" ], "author": { "name": "Hu Wang", "email": "huw@qti.qualcomm.com", "time": "Mon Jul 13 02:26:58 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jul 20 21:06:09 2026" }, "message": "Fix use-after-free in EVENT_ASSOC for driver-offloaded roam+auth\n\nFor drivers that offload key management during roaming to firmware (but\nstill use wpa_supplicant for 4-way handshake on initial connection), the\nroam+auth vendor event delivers association and authorization together.\nDuring MLO roam events, wpa_supplicant_event_assoc() may find no\nmatching network configuration and trigger deauthentication. The\ndeauthentication path in nl80211_mark_disconnected() frees the driver\nBSS data containing auth/key material. After\nwpa_supplicant_event_assoc() returns, wpa_supplicant_event_assoc_auth()\nis still called and dereferences the freed buffer in\nwpa_sm_set_rx_replay_ctr(), causing a use-after-free crash.\n\nThis does not affect drivers like ath12k that do not offload key\nmanagement during roaming, since the auth completion path is not taken\nin the same event flow.\n\nFix this by extending wpa_supplicant_event_assoc() to return an int\nstatus: 0 on success, -1 if it triggered disconnection. The caller\nchecks the return value and breaks out of event processing on failure,\navoiding the subsequent assoc_auth call with stale pointers.\n\nSigned-off-by: Hu Wang \u003chuw@qti.qualcomm.com\u003e\n" }, { "commit": "3b201c4864162d78ccc6dd8a61573ff7eff4dccd", "tree": "46709b425a99e24d72c4bbbaf344c9f74d1844a8", "parents": [ "2d5e6c33e452276218d4bf228a423177e86ce50d" ], "author": { "name": "Rameshkumar Sundaram", "email": "rameshkumar.sundaram@oss.qualcomm.com", "time": "Wed Jul 01 06:57:12 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jul 20 20:47:36 2026" }, "message": "Fix incorrect iface removal during config reload for AP MLD\n\nhostapd_reload_config() currently removes interfaces by matching the\ninterface name. In AP MLD configurations, multiple links can share the\nsame interface name, which can result in removing the wrong interface\nduring reload. For example, reloading the 2.4 GHz link may incorrectly\nremove the 6 GHz interface.\n\nExample:\n iface[0]-\u003ebss[0] \u003d\u003e wlan0.0 \u003d\u003e 6 GHz\n iface[1]-\u003ebss[0] \u003d\u003e wlan0.0 \u003d\u003e 5 GHz\n iface[2]-\u003ebss[0] \u003d\u003e wlan0.0 \u003d\u003e 2.4 GHz\n\nFix this by introducing hostapd_remove_hapd_iface(), which removes an\ninterface by pointer comparison instead of name matching, and use it in\nhostapd_reload_config(). Also refactor hostapd_remove_iface() to reuse\nthis helper and avoid code duplication.\n\nSigned-off-by: Rameshkumar Sundaram \u003crameshkumar.sundaram@oss.qualcomm.com\u003e\n" }, { "commit": "2d5e6c33e452276218d4bf228a423177e86ce50d", "tree": "d336d81bbc89c32bfb3c4c4281cb17438bb9304f", "parents": [ "2f729c9160713c6aa08d1f1b8f4279e7e772f554" ], "author": { "name": "Rameshkumar Sundaram", "email": "rameshkumar.sundaram@oss.qualcomm.com", "time": "Fri Jul 03 10:29:52 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jul 20 20:30:44 2026" }, "message": "hostapd: Set BSS Color Disabled\u003d1 during CCA countdown\n\nIEEE Std 802.11-2024, 26.17.3.5.1 (Detecting and reporting BSS color\ncollision, General) states:\n\"The HE AP shall set the BSS Color Disabled subfield to 1 in the HE\nOperation element that it transmits if the BSS color collision persists\nfor a duration of at least dot11BSSColorCollisionAPPeriod and if\ndot11BSSColorCollisionAPPeriod is not -1.\"\n\n26.17.3.4 (Selecting and advertising a new BSS color) states:\n\"During the time leading up to the BSS color change TBTT,\n - An HE AP shall set the BSS Color Disabled subfield to 1 and shall\n continue to advertise the existing BSS color via the BSS Color\n subfield in the HE Operation element.\"\nand\n\"At the BSS color change TBTT, an HE AP shall\n - Set the BSS Color Disabled subfield in the HE Operation element\n that it transmits to 0 ...\"\n\nTwo code paths that initiate a BSS Color Change Announcement (CCA) do\nnot comply with these requirements.\n\n1. hostapd_switch_color_timeout_handler() fires after\n dot11BSSColorCollisionAPPeriod (50 s) has elapsed and, when a free\n color is found, initiates CCA without setting he_bss_color_disabled\u003d1\n and beacon_cca is built from the current config (Disabled\u003d0).\n\n2. hostapd_ctrl_iface_color_change() explicitly resets\n he_bss_color_disabled\u003d0 before calling hostapd_fill_cca_settings().\n This causes beacon_cca to advertise Disabled\u003d0 during\n the CCA countdown.\n\nFix this by setting he_bss_color_disabled before triggering CCA and\nupdate hostapd_fill_cca_settings() to build beacon_after with\nhe_bss_color_disabled\u003d0 and the new color, matching the post-TBTT state\nrequired by 26.17.3.4.\n\nFixes: 654d2395dddf (\"BSS coloring: Handling of collision events and triggering CCA\")\nFixes: d8e1a353a636 (\"hostapd: Add support to change BSS color from the control interface\")\nSigned-off-by: Rameshkumar Sundaram \u003crameshkumar.sundaram@oss.qualcomm.com\u003e\n" }, { "commit": "2f729c9160713c6aa08d1f1b8f4279e7e772f554", "tree": "866790d6d915662461f72fec53143515962c579d", "parents": [ "39366e0ac9e2a3942df6267e4a5776e4d41ca993" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Wed May 20 22:42:08 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jul 20 17:18:33 2026" }, "message": "Add OKC fallback for driver-derived PMKID in association matching\n\nSome drivers perform OKC-based roaming internally by cloning the\nprevious PMKSA entry and deriving a new PMKID for the target AP (using\nthe same PMK with the new AA), then including that PMKID in the\n(Re)Association Request frame without notifying wpa_supplicant.\n\nSet params.okc_pmkid_in_assoc when the driver advertises\nWPA_DRIVER_FLAGS2_OKC_PMKID_IN_ASSOC and OKC is enabled for the current\nRSN network, to signal wpa_supplicant readiness to the driver.\n\nAdd wpa_find_assoc_pmkid_okc() as a fallback in wpa_find_assoc_pmkid()\nwhen no direct PMKID match is found and the driver advertises\nWPA_DRIVER_FLAGS2_OKC_PMKID_IN_ASSOC. It derives the OKC PMKID from the\ncurrent connection\u0027s PMKSA without creating a cache entry, compares it\nagainst the PMKIDs in the (Re)Association Request frame RSNE, and only\non a match clones the PMKSA entry for the target AP via\npmksa_cache_clone_entry() and sets it as the current PMKSA. SAE and FILS\nAKMs are skipped since they reuse the original PMKID when cloning and\nwould have already been matched by the direct lookup.\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "39366e0ac9e2a3942df6267e4a5776e4d41ca993", "tree": "ca40dac14455368b2a9fdb159473608494b6fdbe", "parents": [ "7eed0be751ea80d4e030be007cedbe3ea58cd334" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Wed May 20 22:41:49 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jul 20 17:10:39 2026" }, "message": "nl80211: Add WPA_DRIVER_FLAGS2_OKC_PMKID_IN_ASSOC capability flag\n\nDefine WPA_DRIVER_FLAGS2_OKC_PMKID_IN_ASSOC to represent driver support\nfor adding an OKC derived PMKID in (Re)Association Request frames,\nmapped from QCA_WLAN_VENDOR_FEATURE_OKC_PMKID_IN_ASSOC in\nqca_nl80211_get_features().\n\nAdd the okc_pmkid_in_assoc field to wpa_driver_associate_params to carry\nwpa_supplicant\u0027s OKC PMKID handling capability to the driver layer, and\nadvertise QCA_CONNECT_EXT_FEATURE_OKC_PMKID_IN_ASSOC to the driver via\nQCA_NL80211_VENDOR_SUBCMD_CONNECT_EXT when the field is set.\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "7eed0be751ea80d4e030be007cedbe3ea58cd334", "tree": "6f12fe8d8c14ed01cd2e4da99b8dc43bf10fde0b", "parents": [ "66512a029c399c9d7e92f991eac8e6c8b9fa1f8f" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Wed May 20 22:41:34 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jul 20 16:36:07 2026" }, "message": "RSN: Refactor PMKID derivation into pmksa_cache_derive_pmkid() utility\n\nExtract the PMKID derivation logic (Suite B via KCK, all other cases via\nPMK) from pmksa_cache_add() into a new exported utility function\npmksa_cache_derive_pmkid(). Also export pmksa_cache_clone_entry() which\nwas previously static.\n\nThis is a pure refactor with no behavior change; the new helpers will be\nreused by the OKC fallback path added in a subsequent commit.\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "66512a029c399c9d7e92f991eac8e6c8b9fa1f8f", "tree": "6b9c75877cc958fb03220d8310077bbc5eb8cc1f", "parents": [ "6b4b4807c2aa4facf94695c6449194b57e0d0911" ], "author": { "name": "Xinyue Ling", "email": "xinyling@qti.qualcomm.com", "time": "Thu Jul 16 05:54:40 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jul 20 10:56:46 2026" }, "message": "Fix wrong channel width of 2.4 GHz link in MLO_STATUS\n\nget_sta_operation_chan_width() intersected the AP\u0027s operation channel\nwidth with the STA\u0027s supported width only for 320/160/80+80 MHz. For a\n40 MHz AP it returned ap_operation_chan_width unconditionally, never\nconsulting whether the STA actually supports 40 MHz.\n\nAs a result, on a 2.4 GHz link where the AP advertises 40 MHz in its HT\nOperation element (STA Channel Width \u003d 1, secondary channel present) but\nthe local STA advertises only 20 MHz support (HT Supported Channel Width\nSet \u003d 0 and HE 40 MHz-in-2.4 GHz \u003d 0) in its (Re)Association Request\nframe, MLO_STATUS reported channel_width\u003d40 instead of the negotiated 20\nMHz.\n\nAdd is_40_supported to struct supported_chan_width and populate it in\nget_supported_channel_width() from the STA capabilities. 40 MHz support\nis band specific, so use the HT Capabilities Info Supported Channel\nWidth Set bit (band agnostic) or the HE PHY Capabilities Channel Width\nSet bit selected by band (40 MHz-in-2.4 GHz for 2.4 GHz, 40/80 MHz-in-5\nGHz otherwise). The frequency is now passed into\nget_supported_channel_width() by both callers.\n\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "6b4b4807c2aa4facf94695c6449194b57e0d0911", "tree": "03c60ead6f0dfc8a926cd2491fde8bf59d7c7ebb", "parents": [ "2b7ec3abf52cbb469e768760601f7af1be43feee" ], "author": { "name": "Gurumoorthi Gnanasambandhan", "email": "gguru@qti.qualcomm.com", "time": "Thu Jul 16 15:51:14 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jul 20 10:10:22 2026" }, "message": "RSNO: Guard MLO RSN Override Link KDE on AP config\n\nwpa_auth_ml_kdes_len() and wpa_auth_ml_kdes() gated emission of the RSN\nOverride Link KDE on the SNonce cookie set by the STA in EAPOL-Key msg\n2/4 alone. Other RSN overriding checks in this file also require\nconf-\u003ersn_override_key_mgmt or conf-\u003ersn_override_key_mgmt_2 to be\nconfigured on the AP. Without that check here, a STA advertising RSN\noverriding support via the SNonce cookie could cause the AP to size and\nadd RSN Override Link KDEs for links where override key mgmt is not\nconfigured, e.g. the AP does not support it.\n\nAdd the same conf-\u003ersn_override_key_mgmt / conf-\u003ersn_override_key_mgmt_2\ncheck used elsewhere before checking rsn_is_snonce_cookie().\n\nFixes: be6e4279fa5f (\"RSNO: Verify all RSNE/RSNXE variants in multi-link cases\")\nSigned-off-by: Gurumoorthi Gnanasambandhan \u003cgguru@qti.qualcomm.com\u003e\n" }, { "commit": "2b7ec3abf52cbb469e768760601f7af1be43feee", "tree": "6289af6da5eb1780aa276fd193bfbaff7c041c2b", "parents": [ "7290cb869ded80a9ea1e48cc3b6861d35ba2d73b" ], "author": { "name": "Govindaraj Saminathan", "email": "govindaraj.saminathan@oss.qualcomm.com", "time": "Thu Jul 16 11:00:41 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jul 20 09:12:08 2026" }, "message": "hostapd: Reset num_multi_hws on interface cleanup\n\nhostapd_cleanup_iface_partial() frees and NULLs iface-\u003emulti_hw_info but\nleaves iface-\u003enum_multi_hws at its previous non-zero value. If\nhostapd_set_current_hw_info() is called after a partial cleanup (e.g.,\nduring interface restart), it skips the early return and dereferences\nthe already-freed multi_hw_info array.\n\nReset num_multi_hws to 0 alongside the NULL assignment so the two fields\nremain consistent.\n\nSigned-off-by: Govindaraj Saminathan \u003cgovindaraj.saminathan@oss.qualcomm.com\u003e\n" }, { "commit": "7290cb869ded80a9ea1e48cc3b6861d35ba2d73b", "tree": "555513a618341faa8f1f96e2d4677e24bd20ef1f", "parents": [ "74718c75f668f3436b95122bb99bfc71f40e63ce" ], "author": { "name": "Dhanavandhana Kannan", "email": "dhanavandhana.kannan@oss.qualcomm.com", "time": "Tue Jul 14 09:24:23 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jul 20 09:10:56 2026" }, "message": "AP MLD: Fix stale mld_link_info fields on back-to-back MLD reassociation\n\nCurrently, when a non-AP MLD sends a Reassociation Request frame without\na preceding authentication exchange, hostapd reuses the existing station\nentry and re-parses the per-link information. In this path, only the\nvalid flag of each link entry is cleared, while other per-link state\nremains preserved from the previous association.\n\nThis issue is observed when consecutive reassociation requests carry\ndifferent MLE content, for example when the station first associates\nwith a certain set of links and subsequently sends another Reassociation\nRequest frame with a reduced or modified set of links.\n\nDue to this incomplete reset, stale per-link information is considered\nduring parsing of the new request. This results in incorrect validation\nof the received data, causing the Reassociation Request frame to be\nrejected.\n\nIn addition, dynamically allocated per-link profile data is not released\nin this reset path, resulting in a memory leak on repeated reassociation\nattempts.\n\nFix this by preserving the association link\u0027s peer_addr and local_addr\nbefore reset, freeing any existing per-link profile allocations, and\nfully clearing the link information to remove stale state. The\nassociation link\u0027s valid state and saved addresses are then restored\nafter reset. Also ensure that these allocations are released on error\npaths before clearing the full MLD information to avoid memory leaks.\n\nFixes: 5f5db9366cde (\"AP: MLO: Process Multi-Link element from (Re)Association Request frame\")\nSigned-off-by: Dhanavandhana Kannan \u003cdhanavandhana.kannan@oss.qualcomm.com\u003e\n" }, { "commit": "06d7ba028693f50d25a964ed83dd056d7e995445", "tree": "e1e3ffdfe6fcd053f0d0a0040b3c183d604a8a08", "parents": [ "89470a69aeb3b8fc58bd6c77b45ec5157aa95499" ], "author": { "name": "Vinay Gannevaram", "email": "quic_vganneva@quicinc.com", "time": "Fri Feb 14 12:34:28 2025" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 15 03:11:48 2026" }, "message": "UPSTREAM: Update the link BSS pointer during BSS reallocation on scan results\n\nWhen updating the BSS during a scan results event, reallocation of the\nBSS due to needing more room for IEs results in a new allocation and the\npointer changing. Update the link BSS pointer to the newly allocated BSS\nsimilarly to the other cases that were covered previously. This is\nneeded to avoid use of freed memory in some MLO cases.\n\nSigned-off-by: Vinay Gannevaram \u003cquic_vganneva@quicinc.com\u003e\n\n(cherry picked from commit 53303bb3e7437961d942f2b090c17d0b9f134e18)\nSigned-off-by: David Ruth \u003cdruth@chromium.org\u003e\n\nBUG\u003db:516659128\nTEST\u003dCompiles cleanly and verified MLO BSS update functionality\n\nChange-Id: Ie5e39ef54f9e31862a59fe40fc3115bca0b326e8\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/hostap/+/8088543\nTested-by: David Ruth \u003cdruth@chromium.org\u003e\nCommit-Queue: David Ruth \u003cdruth@chromium.org\u003e\nReviewed-by: Jintao Lin \u003cjintaolin@chromium.org\u003e\n" }, { "commit": "89470a69aeb3b8fc58bd6c77b45ec5157aa95499", "tree": "ca367366e2329cac74bed6dcc396f4b4645fe288", "parents": [ "08a71be8c273a2fbe1b5f6ac0464d70b1231b972" ], "author": { "name": "Ramasamy Kaliappan", "email": "ramasamy.kaliappan@oss.qualcomm.com", "time": "Mon May 25 04:05:49 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Wed Jul 15 01:26:18 2026" }, "message": "UPSTREAM: nl80211: Fix use after free bss during radar event\n\nWhen processing an NL80211_CMD_RADAR_DETECT event, it attempts to switch\nto a new available channel. If no valid channels are available, it\ndisables and re-enables the interface, which deinitializes all BSSes and\nreinitializes the driver BSSs. However, the loop in the\nprocess_global_event() function continues to access the old, deallocated\nBSS addresses in the next iteration, leading to a crash.\n\nTo fix this issue, ensure that before the next iteration, the BSS exists\nin the BSS list before accessing it.\n\nSigned-off-by: Ramasamy Kaliappan\u003cramasamy.kaliappan@oss.qualcomm.com\u003e\n\n(cherry picked from commit b0d09f2f41efc0e57b536b89fbdf5f5198e02e5b)\nSigned-off-by: David Ruth \u003cdruth@chromium.org\u003e\n\nBUG\u003db:516630469\nTEST\u003dCompiles cleanly\n\nChange-Id: I81e05b3622b015e336970b56045b73dd57f652eb\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/hostap/+/8087307\nCommit-Queue: David Ruth \u003cdruth@chromium.org\u003e\nReviewed-by: Jintao Lin \u003cjintaolin@chromium.org\u003e\nTested-by: David Ruth \u003cdruth@chromium.org\u003e\n" }, { "commit": "08a71be8c273a2fbe1b5f6ac0464d70b1231b972", "tree": "c378f1a7b54f3c8fa12873547a984b5597c2226e", "parents": [ "781e9e7bb9779532fa26bf16d4ba2fb88e961eb3" ], "author": { "name": "Jouni Malinen", "email": "quic_jouni@quicinc.com", "time": "Tue Jan 21 17:34:23 2025" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Sat Jul 11 01:23:35 2026" }, "message": "UPSTREAM: Do not remove a currently used BSS entry when removing oldest unknown BSS\n\nwpa_bss_known() might not be sufficient to catch all cases where a BSS\nentry is in use. One known example of such a case is OWE transition mode\nwhere the SSID of the transition mode AP is not the same as the one in\nthe local network profile. Some other cases might exists as well.\n\nIf the oldest unknown BSS needs to be removed due to running out of room\nin the BSS table and that removed BSS happens to be the currently\nassociated one, wpa_s-\u003ecurrent_bss might become invalid and point to\nfreed memory. This needs to be avoided to prevent use of freed memory,\nso use wpa_bss_in_use() as an extra condition for removing the oldest\nunknown BSS.\n\nSigned-off-by: Jouni Malinen \u003cquic_jouni@quicinc.com\u003e\n\n(cherry picked from commit b0f58794420df2fcc195b160e7fd8aa4bf86be2d)\nSigned-off-by: David Ruth \u003cdruth@chromium.org\u003e\n\nBUG\u003db:515779476\nTEST\u003dCompiles cleanly\n\nChange-Id: I537edc1b7e5003f67adec3e6cd36ac97b215a2b9\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/hostap/+/8077698\nCommit-Queue: David Ruth \u003cdruth@chromium.org\u003e\nTested-by: David Ruth \u003cdruth@chromium.org\u003e\nReviewed-by: Jintao Lin \u003cjintaolin@chromium.org\u003e\n" }, { "commit": "781e9e7bb9779532fa26bf16d4ba2fb88e961eb3", "tree": "8f0c888a32358ff2489b0ffdc6e25f08cba42314", "parents": [ "81a4ad23ea7688251105f1cfa1ba4a061093dc41" ], "author": { "name": "Duy Truong", "email": "duytruong@google.com", "time": "Fri May 22 17:02:17 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Sat Jul 11 01:11:03 2026" }, "message": "UPSTREAM: Fix UAF in ptksa_cache_expire() in supplicant\n\nDefer the execution of the callback e-\u003ecb in ptksa_cache_expire() until\nafter the list iteration is complete. This prevents a use-after-free\nsituation where the callback might trigger ptksa_cache_flush(), which\nfrees multiple entries, including the next entry in the iteration.\n\nSigned-off-by: Amarnath Hullur Subramanyam \u003camarnathhs@google.com\u003e\n\n(cherry picked from commit 13e87134bf5bc5d138f703fe5174313346ac24d0)\nSigned-off-by: David Ruth \u003cdruth@chromium.org\u003e\n\nBUG\u003db:524306860\nTEST\u003dCompiles cleanly and verified with hostap test suite\n\nChange-Id: Ib8cc45ee772ed44282c72176f255550e29b34e93\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/hostap/+/8061203\nReviewed-by: Jintao Lin \u003cjintaolin@chromium.org\u003e\nCommit-Queue: David Ruth \u003cdruth@chromium.org\u003e\nTested-by: David Ruth \u003cdruth@chromium.org\u003e\n" }, { "commit": "74718c75f668f3436b95122bb99bfc71f40e63ce", "tree": "4f5463a23f0556735eb503c19b93a6df03f95f19", "parents": [ "dfd881aab52be9c0965ad613236bdb20ca2440ad" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Fri Jul 10 19:29:46 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jul 10 19:29:46 2026" }, "message": "NAN: Avoid a compiler warning when CONFIG_NAN is not defined\n\nwpas_nan_get_mgmt_iface() is called only within CONFIG_NAN ifdef blocks,\nso define that function with matching condition.\n\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "dfd881aab52be9c0965ad613236bdb20ca2440ad", "tree": "488245bef53a1caecb0f344c50f5031a40d2bab7", "parents": [ "baf3eba700fc37d4aca05ed574931f6a7794dfa1" ], "author": { "name": "Purushottam Kushwaha", "email": "pkushwah@qti.qualcomm.com", "time": "Thu Jul 09 06:17:43 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jul 10 19:28:52 2026" }, "message": "NAN: Fix set_group_key/get_seqnum callbacks build without CONFIG_PASN\n\nwpas_nan_set_group_key_cb() and wpas_nan_get_seqnum_cb() were placed\ninside the CONFIG_PASN ifdef block, but they are assigned in\nwpas_nan_init() outside that block. These callbacks are not PASN\nspecific; they handle NDP group key installation and PN retrieval.\nMove them outside the CONFIG_PASN block to fix the build when\nCONFIG_NAN is enabled without CONFIG_PASN.\n\nSigned-off-by: Purushottam Kushwaha \u003cpkushwah@qti.qualcomm.com\u003e\n" }, { "commit": "baf3eba700fc37d4aca05ed574931f6a7794dfa1", "tree": "59231d62918e055e36034324c89582b897fea5d0", "parents": [ "869f772581901f38a9c9cfb14876c5bd54f9fcdd" ], "author": { "name": "Purushottam Kushwaha", "email": "pkushwah@qti.qualcomm.com", "time": "Thu Jul 09 06:16:29 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jul 10 19:27:37 2026" }, "message": "NAN: Fix wpas_nan_data_interface_removed() build without CONFIG_NAN\n\nwpas_nan_data_interface_removed() was placed outside the CONFIG_NAN\nifdef block, but it accesses wpa_s-\u003enan which is only defined when\nCONFIG_NAN is set. Move the function inside the CONFIG_NAN block to\nfix the build when only CONFIG_NAN_USD is enabled.\n\nSigned-off-by: Purushottam Kushwaha \u003cpkushwah@qti.qualcomm.com\u003e\n" }, { "commit": "869f772581901f38a9c9cfb14876c5bd54f9fcdd", "tree": "d8eaf63e84f9d94b89900e7691a4df5ce162adaf", "parents": [ "a3ed56f65c34bf14946146ab3af9cba5e9b03ff6" ], "author": { "name": "Thirusenthil Kumaran J", "email": "thirusen@qti.qualcomm.com", "time": "Wed May 20 14:19:54 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jul 10 13:26:12 2026" }, "message": "AP: Fix operating class in ECSA element for EHT BSS\n\nCurrently, when the AP initiates a channel switch to a channel where the\nEHT bandwidth is different from the legacy (pre-11be) bandwidth, the\noperating class in the ECSA element is set to the operating class\ncorresponding to the EHT bandwidth. The EHT bandwidth differs from that\nof the legacy bandwidth when the target channel is punctured or if the\ntarget channel bandwidth is 320 MHz. This causes legacy (pre-11be)\nstations to ignore the ECSA element and results in disconnection of\nlegacy stations from the AP.\n\nTo fix this, adjust the bandwidth and secondary channel offset used in\nthe calculation of the operating class to be advertised in the ECSA\nelement based on the legacy bandwidth instead of the EHT bandwidth.\n\nSigned-off-by: Thirusenthil Kumaran J \u003cthirusen@qti.qualcomm.com\u003e\n" }, { "commit": "a3ed56f65c34bf14946146ab3af9cba5e9b03ff6", "tree": "94f655e05bcbc0d183060c893c76614f88b2cedc", "parents": [ "daeabd2da0c5a220d5d157a1e15fadb5a1d0ff33" ], "author": { "name": "Shwetha G K", "email": "kshwetha@qti.qualcomm.com", "time": "Tue May 12 10:35:19 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jul 10 13:26:06 2026" }, "message": "AP: Fix operating class derivation for 20 MHz downgraded BSS\n\nAn EHT-capable interface can host an EHT-disabled BSS. In such a case,\nthe advertised legacy bandwidth of the BSS can be downgraded from the\nconfigured interface bandwidth due to 320 MHz or punctured channel\nconfiguration not being applicable for the BSS.\n\nWhen this legacy bandwidth gets downgraded to 20 MHz, the configured\nsecondary channel is no longer valid. However, the current code still\nuses the configured secondary channel together with the BSS-specific\nchannel width while deriving the operating class and channel details.\nThis can result in incorrect operating class information being reported\nin Supported Operating Class, RNR, and neighbor report data.\n\nFix this by deriving the full BSS operating channel information through\nhostapd_get_oper_chan_info_of_bss() and clearing the secondary channel\nwhen the BSS is effectively downgraded to 20 MHz.\n\nFixes: 1aa1600ae29b (\"AP: Add helper functions to get BSS operating class and channel information\")\nFixes: ded7ca609ab1 (\"AP: Fix operating class in RNR element for co-located EHT-disabled BSS\")\nFixes: c1959a379de7 (\"AP: Fix operating class in Supported Operating Class element for EHT-disabled BSS\")\nFixes: c80c8b28aee6 (\"AP: Fix operating class and channel details in neighbor report database\")\nSigned-off-by: Shwetha G K \u003ckshwetha@qti.qualcomm.com\u003e\nSigned-off-by: Amith A \u003camith.a@oss.qualcomm.com\u003e\n" }, { "commit": "daeabd2da0c5a220d5d157a1e15fadb5a1d0ff33", "tree": "e9154d3d9f48dbc6f73ac225bfa1aa5f4888222f", "parents": [ "e201b6507bb8772e96a2f791ebd682bfb51b4c2f" ], "author": { "name": "Sai Pratyusha Magam", "email": "sai.magam@oss.qualcomm.com", "time": "Thu May 07 08:48:12 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jul 10 13:11:34 2026" }, "message": "tests: EPPKE with AP MLD links in different AKMs\n\nAdd an unauthenticated EPPKE case with AP configured in different AKMs.\n\nSigned-off-by: Sai Pratyusha Magam \u003csai.magam@oss.qualcomm.com\u003e\n" }, { "commit": "e201b6507bb8772e96a2f791ebd682bfb51b4c2f", "tree": "29e093f67f0ba2c5fd3b40ca2e4d3368bdf37e53", "parents": [ "af4da04e5b8dcf756710709ddb9c121b63db2cf3" ], "author": { "name": "Sai Pratyusha Magam", "email": "sai.magam@oss.qualcomm.com", "time": "Thu May 07 08:48:11 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jul 10 13:10:53 2026" }, "message": "EPPKE: Include RSNE in Per-STA profile of MLE when applicable\n\nPer IEEE P802.11bi/D4.0, 9.3.3.6 (Association Response frame format), an\nencrypted (Re)Association Response frame includes an RSNE.\n\nIf the RSNE contents of the association link authenticator is not\nexactly the same as that for the partner AP, include the RSNE of the\npartner AP in its Per-STA profile. This might happen, e.g., if the group\ncipher suites differ or if RSN overriding is used on some of the links\nbut no on the association link.\n\nSigned-off-by: Sai Pratyusha Magam \u003csai.magam@oss.qualcomm.com\u003e\n" }, { "commit": "af4da04e5b8dcf756710709ddb9c121b63db2cf3", "tree": "cbe53119ea641e879ee70a47c0233c518b787013", "parents": [ "33b4c370f7de02844490c3978c72ac44f24f5609" ], "author": { "name": "Sai Pratyusha Magam", "email": "sai.magam@oss.qualcomm.com", "time": "Thu May 07 08:48:10 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jul 10 13:07:24 2026" }, "message": "AP MLD: Include RSNXE in Per-STA profile of MLE when applicable\n\nPer IEEE Std 802.11be-2024, 35.3.3.6 (Inheritance in a Per-STA profile),\nan element is included in the Per-STA profile of the reported STA, if\nthe contents of the element for the reporting STA are not exactly the\nsame as that of the reported STA and if the element carried in the\nreporting STA is not applicable for the reported STA, list it in the\nNon-Inheritance element.\n\nThis scenario where the RSNXE contents vary in the AP MLD links is of\nrelevance for the RSN override cases where the 2.4 GHz and 5 GHz links\nare configured in WPA2-PSK and use the RSNXOE while the 6 GHz link is\nconfigured in WPA3 and includes an RSNXE.\n\nSigned-off-by: Sai Pratyusha Magam \u003csai.magam@oss.qualcomm.com\u003e\n" }, { "commit": "33b4c370f7de02844490c3978c72ac44f24f5609", "tree": "ae95dd49dd79a25ec5df031c07bfaf44da451cdc", "parents": [ "5859d1132160c2d90c50c537d35830b4d0ab3444" ], "author": { "name": "Xinyue Ling", "email": "xinyling@qti.qualcomm.com", "time": "Mon May 25 02:25:04 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jul 10 12:25:37 2026" }, "message": "Fix wrong current_mode selection for 6 GHz ACS result\n\nWhen ACS completes on a 6 GHz channel (e.g., iface-\u003efreq\u003d6295 MHz),\nhostapd_acs_channel_selected() selects current_mode by iterating\nhw_features and skipping modes whose type matches acs_res-\u003ehw_mode\nbut that do not contain iface-\u003efreq. The skip check previously used\nhw_get_chan(), which searches all hw_features entries of the given\nmode type rather than the specific mode instance under test. Since\nboth 5 GHz and 6 GHz report HOSTAPD_MODE_IEEE80211A, searching all\nhw_features for freq\u003d6295 MHz finds it in the 6 GHz entry, causing\nthe 5 GHz mode to NOT be skipped. The loop therefore terminates with\ncurrent_mode pointing to the 5 GHz hw_features entry instead of the\n6 GHz one.\n\nSubsequent DFS processing then operates on the 5 GHz channel table\nwith a 6 GHz channel number, producing \"DFS chan_idx seems wrong\".\n\nTo fix this, replace hw_get_chan() with hw_mode_get_channel(), which\nlimits the frequency search to the specific mode instance being\nevaluated, correctly skipping the 5 GHz entry when iface-\u003efreq is a\n6 GHz frequency.\n\nSigned-off-by: Xinyue Ling \u003cxinyling@qti.qualcomm.com\u003e\n" }, { "commit": "5859d1132160c2d90c50c537d35830b4d0ab3444", "tree": "5c9a25b44a53a7101c5542ac8f69ec3e19f805f9", "parents": [ "bf68417eec8d399e824db99782c977724c1d5664" ], "author": { "name": "Rameshkumar Sundaram", "email": "rameshkumar.sundaram@oss.qualcomm.com", "time": "Wed Jul 08 09:19:52 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jul 10 09:51:06 2026" }, "message": "AP: Fix argument order in ap_sta_disconnect_common() debug print\n\nThe wpa_printf() call in ap_sta_disconnect_common() had\nMAC2STR(sta-\u003eaddr) and timeout swapped relative to the format string.\nThe format string uses %u first (for timeout) followed by MACSTR (for\nthe MAC address), but the arguments were passed in the opposite order,\nresulting in garbled log output.\n\nFix the argument order to match the format string.\n\nFixes: e9f75a3520e6 (\"AP: Unify code handling deauthentication/disassociation\")\nSigned-off-by: Rameshkumar Sundaram \u003crameshkumar.sundaram@oss.qualcomm.com\u003e\n" }, { "commit": "bf68417eec8d399e824db99782c977724c1d5664", "tree": "13a1ede8faf741d3b88183bb1d0587dc3bc022f9", "parents": [ "46ff81b25d47b8e71d170ceaeb6328e221e2297f" ], "author": { "name": "Govindaraj Saminathan", "email": "govindaraj.saminathan@oss.qualcomm.com", "time": "Fri Jul 10 06:08:24 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jul 10 09:49:11 2026" }, "message": "nl80211: Prevent stale event from matching active command reply sequence\n\nWhen an event handler called from nl80211_deliver_pending_events()\nissues a driver command, the nested send_and_recv_glb() call appends\nnew events to global-\u003epending_events while it waits for its reply. On\nreturn, nl80211_reply_hook() sees global-\u003epending_events as non-empty\nand re-queues the current event instead of processing it. This repeats\nfor every remaining event in the delivery batch.\n\nThe sequence that triggers the bug:\n\n Phase 1 - kernel events arrive during a sync command:\n send_and_recv_glb() sets sync_reply_handling\u003dtrue, reply_seq\u003dSEQ_1\n nl_recvmsgs() receives events E1, E2, E3\n -\u003e nl80211_reply_hook(): sync\u003dtrue, seq !\u003d SEQ_1 -\u003e queued\n -\u003e global-\u003epending_events \u003d {E1, E2, E3}\n ACK(SEQ_1) arrives -\u003e loop exits\n sync_reply_handling\u003dfalse, reply_seq\u003d0\n\n Phase 2 - delivery; E1\u0027s handler issues a nested command:\n nl80211_deliver_pending_events() is called by eloop\n {E1,E2,E3} moved from global-\u003epending_events to a stack-local\n list; global-\u003epending_events \u003d {} (now empty)\n local list \u003d {E1, E2, E3} \u003c- iterated by the delivery loop\n Delivers E1 -\u003e handler calls send_and_recv_glb()\n sync_reply_handling\u003dtrue, reply_seq\u003dSEQ_2\n nl_recvmsgs() receives F1, F2\n -\u003e nl80211_reply_hook(): sync\u003dtrue, seq !\u003d SEQ_2 -\u003e queued\n -\u003e global-\u003epending_events \u003d {F1, F2}\n ACK(SEQ_2) -\u003e send_and_recv_glb() returns\n sync_reply_handling\u003dfalse\n global-\u003epending_events \u003d {F1, F2} \u003c- non-empty now\n local list still has {E2, E3} \u003c- not yet delivered\n\n Phase 3 - the re-queuing trap (without this fix):\n Delivery loop resumes; delivers E2 -\u003e nl80211_reply_hook()\n sync_reply_handling\u003dfalse\n global-\u003epending_events \u003d {F1, F2} \u003c- non-empty!\n -\u003e re-queues E2 into global: pending_events \u003d {F1, F2, E2}\n -\u003e returns NL_SKIP\n E2 is removed from the local list but not processed; it will\n only be re-delivered in the next eloop cycle, behind F1 and F2.\n E3 suffers the same fate.\n\nUnder sustained high-frequency command sequences the re-queuing\naccumulates stale events. Each retains its original kernel sequence\nnumber. When the accumulated count is large enough, a stale event\u0027s\nnlmsg_seq coincidentally matches the reply_seq of an active\nsend_and_recv_glb() call. nl80211_reply_hook() fires the reply handler\nwith the wrong message, writing garbage into the caller\u0027s local stack\nvariable and causing SIGSEGV.\n\nFix: add a delivering_pending_events flag to nl80211_global, set it\naround the delivery loop in nl80211_deliver_pending_events(), and skip\nthe re-queue in nl80211_reply_hook() when the flag is set.\n\nAn event delivered from the local list was queued before any event\nthat arrives during delivery; re-queuing it behind those later arrivals\nreverses order rather than preserving it. Processing it directly keeps\ncorrect arrival order; new events that arrive during delivery are\nqueued and handled in the next eloop cycle.\n\nFixes: f5790e97cd64 (\"nl80211: Delay event processing during command handling\")\nSigned-off-by: Govindaraj Saminathan \u003cgovindaraj.saminathan@oss.qualcomm.com\u003e\n" }, { "commit": "46ff81b25d47b8e71d170ceaeb6328e221e2297f", "tree": "179a3bb54aa94b97695ae69bc86052760944dfb6", "parents": [ "be37c3a8a0c3589700d81ff82f6b1a9833627762" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Wed Jun 17 04:36:15 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jul 10 09:26:42 2026" }, "message": "Add QCA_WLAN_VENDOR_ATTR_CONFIG_AUX_LISTEN attribute\n\nAdd a new attribute to the SET_WIFI_CONFIGURATION vendor command to\nenable or disable the AUX listen feature on WCN chipsets. The AUX\nradio is a dedicated low-power Rx chain that can handle listen duty\nduring the Idle Timeout (ITO) period instead of the main MAC, reducing\noverall listen power consumption.\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "be37c3a8a0c3589700d81ff82f6b1a9833627762", "tree": "59f9281d02f24c1cbeb1aba21b4db2f033beccfb", "parents": [ "b57ee6cfcce5b2c486001f7c416dad176b3b567c" ], "author": { "name": "Vamsi Krishna", "email": "vamsin@qti.qualcomm.com", "time": "Fri Jun 19 09:51:23 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 17:11:48 2026" }, "message": "qca-vendor: Add user link switch reason to link state change reasons\n\nAdd QCA_WLAN_VENDOR_STATE_CHANGE_REASON_USER_LINK_SWITCH to\nenum qca_wlan_vendor_link_state_change_reason to indicate that a link\nstate change was triggered by the user initiated link switch assessment\nprocedure. This reason is reported via the\nQCA_NL80211_VENDOR_SUBCMD_LINK_STATE_CHANGE event.\n\nSigned-off-by: Vamsi Krishna \u003cvamsin@qti.qualcomm.com\u003e\n" }, { "commit": "b57ee6cfcce5b2c486001f7c416dad176b3b567c", "tree": "91fd88447c895771b33035efa1325dac4bb8fa86", "parents": [ "e410b3f9bb4b348b249660caf30f3dee62a14bf9" ], "author": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Wed Jun 24 09:49:29 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:19:43 2026" }, "message": "tests: Configuration of alternative SAE password identifiers\n\nSigned-off-by: Jouni Malinen \u003cj@w1.fi\u003e\n" }, { "commit": "e410b3f9bb4b348b249660caf30f3dee62a14bf9", "tree": "63fcb58f9c4f05349111c77f1bfa49142fbe3967", "parents": [ "a4625d221d08d49f5dcda83af0a47576a94755a7" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Thu May 21 13:43:42 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:19:43 2026" }, "message": "tests: Add a fuzz tester for wpa_supplicant scan result processing\n\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "a4625d221d08d49f5dcda83af0a47576a94755a7", "tree": "0be86e8678f5f1ab81b2279747fb2a21461119ec", "parents": [ "039a2ad824689b1aba62facd4fc4ef382e838ec3" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Tue Mar 31 21:12:30 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:19:43 2026" }, "message": "tests: Invalid link ID in Per-STA Profile\n\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "039a2ad824689b1aba62facd4fc4ef382e838ec3", "tree": "9b474f4d5165bf7fe32c9712bd7112f6acae5c64", "parents": [ "0ef6f792cc3752671c4ff68374eda3e30ca74845" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Thu Jul 09 09:35:52 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "Guard against a corner case for airtime policy quantum\n\nmax_wt might be 0 here at least in theory, so avoid division by zero if\nthat were to happen.\n\nCredit to NVIDIA Project Vanessa for discovering and reporting this\nissue.\n\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "0ef6f792cc3752671c4ff68374eda3e30ca74845", "tree": "9a64647c3a6b377cf545acc42d0b4c9f6e0140d8", "parents": [ "b5822d03329055f2e0e3b00e1772709abdc89197" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Thu Jul 09 09:00:51 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "Fix hostapd.conf parser checks for HE SPR bitmaps\n\nThe range of valid values for the he_spr_srg_bss_colors and\nhe_spr_srg_partial_bssid configuration parameters is 0-63, but the\nparser would have accepted value 64. That invalid value would have\nresulted in writing one byte beyond the end of the buffer.\n\nCredit to NVIDIA Project Vanessa for discovering and reporting this\nissue.\n\nFixes: f728c867e302 (\"AP: Extend Spatial Reuse Parameter Set\")\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "b5822d03329055f2e0e3b00e1772709abdc89197", "tree": "e35ff02bb0dca52e5afd9918e46c1e875596d2b6", "parents": [ "7e4e6caebed5335e05f36996930be209e5e1f6af" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Thu Jul 09 08:55:52 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "af_alg: Fix rc4_skip() to not use freed buffer for recvmsg()\n\nBoth sendmsg() and recvmsg() needs to skip the same number of bytes from\nthe beginning and while msg_iov is set properly to cover that, the\ntemporary buffer used for the skipped data was freed before the\nrecvmsg() call. Fix this by freeing the buffer only after that call.\n\nCredit to NVIDIA Project Vanessa for discovering and reporting this\nissue.\n\nFixes: 206516e8c2bd (\"af_alg: Crypto wrappers for Linux kernel crypto (AF_ALG)\")\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "7e4e6caebed5335e05f36996930be209e5e1f6af", "tree": "da8847ee5e498dcc44483635a6c2962287a63c56", "parents": [ "79eef8837bd5523a4094fbc476c02581cf9f3d00" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Thu Jul 09 08:47:47 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "Fix EHT Operation element bounds check for determining puncture bitmap\n\nThe check for the length of the received element was insufficient to\ncover the optionally present disabled subchannels bitmap field. This\ncould have resulted in reading five octets beyond the end of the\nelement. Check the length of this element to be large enough to include\nthe optional field before reading that field.\n\nCredit to NVIDIA Project Vanessa for discovering and reporting this\nissue.\n\nFixes: 7e2c721f0339 (\"Enhance throughput estimation for punctured EHT APs\")\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "79eef8837bd5523a4094fbc476c02581cf9f3d00", "tree": "2d14fa339706cf51471b749063c0478a5aff9b80", "parents": [ "90d5d179a50268be36b6129ce96e2c91b7463dbe" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Thu Jul 09 08:34:12 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "DPP2: Fix QR code addition in Controller for not yet started TCP connections\n\nThe TCP connections maintained by the Controller may include instances\nthat have not yet fully started the authentication exchange. conn-\u003eauth\nis NULL for such cases and the iteration of updating all existing\nconnections with a new QR Code (e.g., the DPP_QR_CODE control interface\ncommand) would result in process termination due to dereferencing a NULL\npointer.\n\nCredit to NVIDIA Project Vanessa for discovering and reporting this\nissue.\n\nFixes: fc3efe0834e6 (\"DPP2: Support mutual auth with QR in scan-during-auth-exchange case\")\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "90d5d179a50268be36b6129ce96e2c91b7463dbe", "tree": "6fd79a8bc9541aefbd68d4b6bb80c60d6048a604", "parents": [ "5541f66312a2c1aea19d39a7e383ae4c0ba88d0a" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Thu Jul 09 08:03:02 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "DPP: Fix debug print handling in Authentication Confirm processing\n\nThe debug print here tried to print the incorrect bootstrapping key hash\nfrom auth-\u003epeer_bi instead of auth-\u003eown_bi likely due to a copy-paste\nissue of similar code for the other role. auth-\u003epeer_bi might be NULL\nhere when using non-mutual DPP authentication and as such, this error\ncondition could result in DPP Responder side process termination due to\ndereferencing a NULL pointer in a case where an invalid Authentication\nConfirm message is processed.\n\nCredit to NVIDIA Project Vanessa for discovering and reporting this\nissue.\n\nFixes: 30d27b048ea2 (\"DPP: Authentication exchange\")\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "5541f66312a2c1aea19d39a7e383ae4c0ba88d0a", "tree": "b4d1951fbf537ea1058ddc8ed47f8fbe1a2020da", "parents": [ "4691e72a05588fad3306c75883e21b78848fe6b8" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Thu Jul 09 07:53:44 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "dbus: Fix use-after-free on wpa_s-\u003eifname on removeInterface\n\nwpa_supplicant_remove_iface() frees wpa_s, so this function needs to\nkeep a local copy of wpa_s-\u003eifname to be able to use it after having\nchecked that interface removal succeeds.\n\nCredit to NVIDIA Project Vanessa for discovering and reporting this\nissue.\n\nFixes: 0ba266d86c90 (\"dbus: Add virtual interface create/remove logic to be inline with ctrl_iface\")\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "4691e72a05588fad3306c75883e21b78848fe6b8", "tree": "ee97575882086dcadfa16216f69e3134c14b065f", "parents": [ "397504413247204613b8639233cf196c60d6c321" ], "author": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Wed Jun 24 09:47:35 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "SAE: Fix clearing of alt_sae_password_ids config parameter\n\nThe parser did not clear the ssid-\u003ealt_sae_password_ids pointer when\nfreeing the array of password identifiers. This could result in\ndouble-freeing the memory if attempting to clear that list of\nalternative SAE password identifiers through the control interface.\n\nFix this by explicitly clearing ssid-\u003ealt_sae_password_ids to NULL when\nfreeing the array.\n\nCredit to NVIDIA Project Vanessa for discovering and reporting this\nissue.\n\nFixes: ef228583e331 (\"SAE: Password identifier changing (STA)\")\nSigned-off-by: Jouni Malinen \u003cj@w1.fi\u003e\n" }, { "commit": "397504413247204613b8639233cf196c60d6c321", "tree": "c5012b4346bde70daff0fe7c6e122d127a38165c", "parents": [ "183926cc5bc4fd735bc9d8622af8e5c3345edf64" ], "author": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Wed Jun 24 09:35:41 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "DPP: Fix potential use-after-free after re-init failure in hostapd\n\nWhen DPP_AUTH_INIT is used to start a new DPP operation while the\nexisting one is still in progress, the old context is freed, but the\nhapd-\u003edpp_auth pointer is updated only if statting of the new instance\nsucceeds. In failure case, hapd-\u003edpp_auth is left pointing to freed\nmemory which might be dereferenced if a DPP message is received or a TX\nstatus for a previously transmitted DPP message is processed after this.\n\nFix this by explicitly clearing hapd-\u003edpp_auth to NULL after deinit.\n\nCredit to NVIDIA Project Vanessa for discovering and reporting this\nissue.\n\nSigned-off-by: Jouni Malinen \u003cj@w1.fi\u003e\n" }, { "commit": "183926cc5bc4fd735bc9d8622af8e5c3345edf64", "tree": "aaddda84b3c467037413d89b3283c0bf9cf79614", "parents": [ "13e87134bf5bc5d138f703fe5174313346ac24d0" ], "author": { "name": "Amarnath Hullur Subramanyam", "email": "amarnathhs@google.com", "time": "Mon Jul 06 21:46:23 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "RSN: Update rsne_len check to consider group_mgmt_cipher for ext-auth\n\nThe initial capacity check omits the additional bytes required when\ngroup_mgmt_cipher is valid. If valid group_mgmt_cipher is true, there is\neither a 4 or 6 bytes written, so consider that for rsne_len check to\navoid any buffer overflow risk.\n\nSigned-off-by: Amarnath Hullur Subramanyam \u003camarnathhs@google.com\u003e\n" }, { "commit": "13e87134bf5bc5d138f703fe5174313346ac24d0", "tree": "631cbc74380eb1067b890bfc31da03baf0d99f5d", "parents": [ "f4c7c66d65da58c4dbdc14710b306b8c1ac518b8" ], "author": { "name": "Duy Truong", "email": "duytruong@google.com", "time": "Fri May 22 17:02:17 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "Fix UAF in ptksa_cache_expire() in supplicant\n\nDefer the execution of the callback e-\u003ecb in ptksa_cache_expire() until\nafter the list iteration is complete. This prevents a use-after-free\nsituation where the callback might trigger ptksa_cache_flush(), which\nfrees multiple entries, including the next entry in the iteration.\n\nSigned-off-by: Amarnath Hullur Subramanyam \u003camarnathhs@google.com\u003e\n" }, { "commit": "f4c7c66d65da58c4dbdc14710b306b8c1ac518b8", "tree": "40233dcc4f0890d8cbc648555ad73c5b0144963e", "parents": [ "b316612ff31e58b8575006eac03a8751587cab77" ], "author": { "name": "Duy Truong", "email": "duytruong@google.com", "time": "Wed May 27 04:34:22 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "Update BSS pointers on reallocation for WNM and Interworking\n\nWhen a BSS entry is reallocated due to element growth in\nwpa_bss_update(), some pointers to the original wpa_bss structure are\nnot updated. Specifically, wnm_target_bss and interworking_gas_bss\npointers were left dangling, potentially leading to a heap\nuse-after-free (UAF) condition when these pointers are subsequently\nused.\n\nAdd logic to track and update wnm_target_bss and interworking_gas_bss\npointers if they were pointing to the BSS entry that is being\nreallocated. This matches the existing behavior for other BSS pointers\nlike current_bss and ml_connect_probe_bss.\n\nSigned-off-by: Amarnath Hullur Subramanyam \u003camarnathhs@google.com\u003e\n" }, { "commit": "b316612ff31e58b8575006eac03a8751587cab77", "tree": "745fa8d7c30b35810e2c9a38e3ab0b51ee8ed67c", "parents": [ "f12d55ff652ab2e367425c1392510d10d8b9f638" ], "author": { "name": "Duy Truong", "email": "duytruong@google.com", "time": "Tue May 12 00:25:55 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:35 2026" }, "message": "SAE-PK: Add bounds check for fingerprint_bits\n\nCalculate fingerprint_bits based on password length and ensure it does\nnot exceed the capacity of the fingerprint buffer (SAE_MAX_HASH_LEN). A\nspecially crafted long SAE-PK password in local configuration could\notherwise trigger an out-of-bounds write into the sae_temporary_data\nstructure on the heap if trying to connect to an AP with the same\nspecially crafted password.\n\nSigned-off-by: Amarnath Hullur Subramanyam \u003camarnathhs@google.com\u003e\n" }, { "commit": "f12d55ff652ab2e367425c1392510d10d8b9f638", "tree": "2954472cc76650a9dd9d5b2cf39c2789be99bc32", "parents": [ "9dd9173337047e2bb11b05217c8b085b4a284b96" ], "author": { "name": "Jimi Chen", "email": "jimictw@google.com", "time": "Thu May 21 06:56:54 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jul 09 12:15:10 2026" }, "message": "SAE: Fix crash due to NULL pointer dereference in H2E parsing\n\nIn H2E (Hash-to-Element) mode, sae_parse_commit() parses the optional\nAnti-Clogging Token Container by calling sae_parse_token_container().\n\nHowever, callers of sae_parse_commit() that do not require retrieving\nthe anti-clogging token (such as PASN initiator/responder and SME auth)\npass NULL for the token and token_len output arguments.\n\nIf the peer sends a Commit frame containing a valid Anti-Clogging\nToken Container element, sae_parse_token_container() unconditionally\nsets *token and *token_len, resulting in a NULL pointer dereference\n(SIGSEGV) and crashing wpa_supplicant.\n\nFix this by adding NULL checks before writing to token and token_len.\nUpdate the debug log to print the token directly using \u0027pos\u0027.\n\nFixes: 5e32fb0170f4 (\"SAE: Use Anti-Clogging Token Container element with H2E\")\nSigned-off-by: Amarnath Hullur Subramanyam \u003camarnathhs@google.com\u003e\n" }, { "commit": "9dd9173337047e2bb11b05217c8b085b4a284b96", "tree": "1e786c38b294730d6e93324d862d1b695121108c", "parents": [ "de5e73a03c34d83568afb3183b2b28c8d7641a30" ], "author": { "name": "Duy Truong", "email": "duytruong@google.com", "time": "Thu Apr 30 19:29:05 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jul 07 14:37:45 2026" }, "message": "Fix OOB read of an invalid EHT Operation element in wpa_supplicant\n\nEHT_OPERATION_ELEM_MIN_LEN was defined as 1, which predated the addition\nof basic_eht_mcs_nss_set[4] to the ieee80211_eht_operation structure.\nThis caused a potential heap out-of-bounds read in\nget_eht_operation_channel_width() when the element length was between 1\nand 4 inclusive and the EHT_OPER_INFO_PRESENT flag was set, as it would\ntry to access oper_info at offset 5. That function is used in\nwpa_supplicant to determine the bandwidth of the operating channel from\nAP\u0027s advertised information.\n\nUpdate EHT_OPERATION_ELEM_MIN_LEN to 5 to ensure that the bounds check\ncorrectly accounts for the fixed-size fields preceding the operation\ninformation.\n\nSigned-off-by: Amarnath Hullur Subramanyam \u003camarnathhs@google.com\u003e\n" }, { "commit": "de5e73a03c34d83568afb3183b2b28c8d7641a30", "tree": "af44f719f1466a6c10a908ff6f9d43132d25e39d", "parents": [ "c8dbfba1dec269fdaa1e957261284436c931acf9" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Mon Jul 06 12:33:11 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jul 07 14:37:45 2026" }, "message": "Require network_ctx and AKMP match for accepting PMKSA entry\n\nWhen wpa_supplicant was processing EAPOL-Key msg 1/4 with a PMKID\nindicated by the AP/Authenticator, a PMKSA for the same AA was accepted\nwithout enforcing matching network_ctx (i.e., same network configuration\nblock) and AKMP. This could allow misbehaving APs to make wpa_supplicant\nuse an unacceptable PMKSA entry that was generated for a different\nnetwork for AKMP under certain conditions. This could result in showing\na connection to an incorrect network when an attacker has credentials to\none network in wpa_supplicant configuration, but not to another network.\n\nFix this by accepting the PMKID to set the PMKSA for an association only\nif the PMKSA with the same PMKID is for the same network and was\ngenerated using the same AKMP.\n\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "c8dbfba1dec269fdaa1e957261284436c931acf9", "tree": "7eafa6e6317070422139bf9cdedd471ced20823f", "parents": [ "890d573a18647feb71b08031a2bda41682ed3c6e" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Tue Jul 07 14:17:11 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jul 07 14:37:45 2026" }, "message": "Fix sae_pk_gen build with a crypto library\n\nUse similar build conditions to main hostapd build to avoid compilation\nissues for sae_pk_gen with certain build configurations.\n\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "81a4ad23ea7688251105f1cfa1ba4a061093dc41", "tree": "1e218caa9163e50c1391ba5946a06d2b4ef6a40e", "parents": [ "ddc179f1ce8dfdd67c9a1f68c3ccf612ea0bd8e9" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Tue Mar 31 20:24:04 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jun 22 18:55:58 2026" }, "message": "BACKPORT: UPSTREAM: AP MLD: Fix link ID validation in Basic MLE parsing\n\nLink ID 15 can be indicated in the field, but that is not a valid value\nand must be rejected to avoid issues pointing beyond the array of links\nfor a non-AP MLD. Without this, an invalid MLE could result in writing\nbeyond the end of the buffer and causing process termination or\nunexpected behavior.\n\nFixes: 5f5db9366cde (\"AP: MLO: Process Multi-Link element from (Re)Association Request frame\")\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n(cherry picked from commit 46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187)\n\nConflicts:\n src/ap/ieee802_11_eht.c: Used EHT_PER_STA_CTRL_LINK_ID_MSK constant\n name matching ChromeOS stable branch.\n\nSigned-off-by: David Ruth \u003cdruth@chromium.org\u003e\n\nBUG\u003db:516621278\nTEST\u003dCompiles and verified EHT AP functionality\n\nChange-Id: I8040ae0401e655e208f492ef8e609f8bf4a00efc\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/hostap/+/7963271\nReviewed-by: Jintao Lin \u003cjintaolin@chromium.org\u003e\nCommit-Queue: David Ruth \u003cdruth@chromium.org\u003e\nTested-by: David Ruth \u003cdruth@chromium.org\u003e\n" }, { "commit": "ddc179f1ce8dfdd67c9a1f68c3ccf612ea0bd8e9", "tree": "aa01e9d5c0d7af8c66256a3474b29a40a026229d", "parents": [ "3ae57aef6d39e0f2b9c7974f0e912bbfdfac5cea" ], "author": { "name": "Hu Wang", "email": "quic_huw@quicinc.com", "time": "Wed Nov 06 10:50:04 2024" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jun 22 17:09:52 2026" }, "message": "UPSTREAM: AP: Avoid double free of key data buffer if AES unwrap fails\n\nkey_data_buf was freed when aes_unwrap() failed, and then after goto\nout, key_data_buf would be freed again. The separate feeing on\naes_unwrap() failure is not needed, so remove it.\n\nFixes: 4abc37e67b (\"Support Key Data field decryption for EAPOL-Key msg 2/4 and 4/4\")\nSigned-off-by: Jouni Malinen \u003cquic_jouni@quicinc.com\u003e\n(cherry picked from commit 65d865e62706cbe89dae9be9601c97a5d3b32c9d)\n\nBUG\u003db:516703053\nTEST\u003dRan wpa_cli and verified no double free\n\nSigned-off-by: David Ruth \u003cdruth@chromium.org\u003e\nChange-Id: I0f4711e2ff85e7c3c9def73563c24bd4b8c633d1\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/hostap/+/7958308\nReviewed-by: Sean Paul \u003csean@poorly.run\u003e\nReviewed-by: Jintao Lin \u003cjintaolin@chromium.org\u003e\n" }, { "commit": "3ae57aef6d39e0f2b9c7974f0e912bbfdfac5cea", "tree": "92460ec1816675c716d444992fa9b65c5920c952", "parents": [ "17be76a01b28fc3146bfc2321ea6ed28c28159a5" ], "author": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Apr 06 08:32:06 2026" }, "committer": { "name": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "email": "chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Mon Jun 22 17:04:54 2026" }, "message": "UPSTREAM: OpenSSL: Use ASN1_STRING_length/get0_data() more consistently\n\nSome of the accesses to ASN1_IA5STRING were using direct references to\nthe structure members. Replace those with helper functions to avoid the\ndirect access. This is needed for OpenSSL 4.0.\n\nSigned-off-by: Jouni Malinen \u003cj@w1.fi\u003e\n(cherry picked from commit 141abf49a432c9a0f4f38c47a477ab258ec9e239)\n\nBUG\u003db:516697838\nTEST\u003dCompiles cleanly with OpenSSL 4.0\n\nSigned-off-by: David Ruth \u003cdruth@chromium.org\u003e\nChange-Id: Ica7b47da165f62d5b87fde53f4ac4b6cf8d1b33b\nReviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/hostap/+/7958307\nReviewed-by: Jintao Lin \u003cjintaolin@chromium.org\u003e\n" }, { "commit": "890d573a18647feb71b08031a2bda41682ed3c6e", "tree": "254273b4f04f8e088d3c8971466ab2bc1c45d3ce", "parents": [ "aa96ee0dfec91efc2edf81819cd79750354ab69f" ], "author": { "name": "Shreyat Pandey", "email": "shrepand@qti.qualcomm.com", "time": "Wed Jun 10 06:42:52 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Thu Jun 18 20:50:17 2026" }, "message": "Add QCA vendor interface to support Time Average SAR (TAS)\n\nSAR (Specific Absorption Rate) regulatory compliance requires firmware\nto manage TX power based on active usage scenarios. The existing\nQCA_NL80211_VENDOR_SUBCMD_SET_SAR_LIMITS command configures per-scenario\npower tables, but provides no mechanism to dynamically shift the active\ntable by an offset or query per-band/per-antenna TX power data at\nruntime.\n\nAdd a new vendor subcommand QCA_NL80211_VENDOR_SUBCMD_TAS with a\nmandatory QCA_WLAN_VENDOR_ATTR_TAS_OPERATION attribute that selects the\noperation to perform:\n- QCA_WLAN_TAS_OPERATION_SET_MODE to signal firmware to apply a power\n offset (NONE, +X dB INCREASE, or -Y dB DECREASE) to the active SAR\n table. The X and Y delta values are stored in the BDF file.\n- QCA_WLAN_TAS_OPERATION_GET_METRICS to query per-band/per-antenna TX\n power level classifications relative to the SAR thresholds along with\n the regulatory measurement time window from the firmware.\n- QCA_WLAN_TAS_OPERATION_GET_PLIMIT to query per-chain TX power limits\n for a specified scenario (QCA_WLAN_VENDOR_ATTR_TAS_PLIMIT_SCENARIO)\n from the firmware.\n\nThese additions enable userspace to effectively manage and monitor Wi-Fi\ntransmission power. This helps in complying with SAR regulations while\noptimizing device performance based on factors like device proximity to\nthe body and concurrent Bluetooth activity.\n\nSigned-off-by: Shreyat Pandey \u003cshrepand@qti.qualcomm.com\u003e\n" }, { "commit": "aa96ee0dfec91efc2edf81819cd79750354ab69f", "tree": "8724a55f795635d00c9b8055b25b92a31b984d82", "parents": [ "91e87e3d509ffdf5342d4533e494e4be51e08a1f" ], "author": { "name": "Karthik M", "email": "karthik.m@oss.qualcomm.com", "time": "Mon Jun 15 18:15:57 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Wed Jun 17 12:46:39 2026" }, "message": "AP MLD: Clear reserved fields in EML capability for AP MLD\n\nAs per IEEE Std 802.11be-2024, 9.4.2.322.2.3 (Common Info field of the\nBasic Multi-Link element), the EMLSR/EMLMR Padding Delay and EMLSR/EMLMR\nTransition Delay fields in the EML Capabilities subfield are reserved in\nframes sent by an AP affiliated with an AP MLD. Hence, clear these\nfields received from the driver to send out the expected value 0 for the\nreserved fields.\n\nSigned-off-by: Karthik M \u003ckarthik.m@oss.qualcomm.com\u003e\nSigned-off-by: Manish Dharanenthiran \u003cmanish.dharanenthiran@oss.qualcomm.com\u003e\n" }, { "commit": "91e87e3d509ffdf5342d4533e494e4be51e08a1f", "tree": "5caa4e4cb869c58521ea2220b95b31a07539dae8", "parents": [ "064558c5375b4ea0e4f607b0f9d21924e62212c5" ], "author": { "name": "Gaole Zhang", "email": "gaole.zhang@oss.qualcomm.com", "time": "Tue Jun 16 04:19:11 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Wed Jun 17 12:36:43 2026" }, "message": "wpa_supplicant: Enable WNM in defconfig by default\n\nIEEE 802.11v WNM is widely used by access points to improve roaming\nbehavior and power efficiency. With CONFIG_WNM enabled, wpa_supplicant\ncan supports WNM related features such as BSS Transition Management and\nWNM Sleep Mode. Enable CONFIG_WNM in wpa_supplicant/defconfig so it is\nmore likely to be built if this documentation file is used as a starting\npoint for a project build configuration.\n\nSigned-off-by: Gaole Zhang \u003cgaole.zhang@oss.qualcomm.com\u003e\n" }, { "commit": "064558c5375b4ea0e4f607b0f9d21924e62212c5", "tree": "e74c015218e7d6b520b74b8f17dc523a4b3edcb5", "parents": [ "f09e32d1db94e43194311d6ea9286abf692f889d" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Tue Jun 16 20:50:28 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Wed Jun 17 12:35:23 2026" }, "message": "More explicit underflow checks for subelement defragmentation\n\nAdd an underflow guard before the num_frag_subelems*2 subtraction at\nevery call site that lacked one, matching the pattern already in\nieee802_11_parse_link_profile().\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "f09e32d1db94e43194311d6ea9286abf692f889d", "tree": "020ef4cd28f28f82b9658b4d6fbf82a74ee6e9d7", "parents": [ "c5380c865f5cbaf616fc588cc3f5358874bba850" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Tue Jun 16 20:50:28 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Wed Jun 17 12:35:12 2026" }, "message": "Fix stale mlbuf-\u003eused in ieee802_11_defrag_mle_subelem()\n\nieee802_11_defrag_mle_subelem() removes Fragment subelement headers\nin-place via os_memmove() and correctly tracks the shrinkage in its\nlocal \u0027end\u0027 and \u0027len\u0027 variables, but never writes it back to\nmlbuf-\u003eused. Each subsequent call therefore recomputes a stale\nend \u003d buf + wpabuf_len(mlbuf) that is 2 bytes too large per fragment\nremoved by the previous call, leaving mlbuf-\u003eused inconsistent with\nthe actual valid data length.\n\nFix by decrementing mlbuf-\u003eused immediately after each os_memmove(),\nso that mlbuf-\u003eused stays in sync with the buffer contents at every\npoint including on the early return -1 error path.\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "c5380c865f5cbaf616fc588cc3f5358874bba850", "tree": "573554b65ced6d2e987d9db8891f486fb4f579c3", "parents": [ "6183590a5a9eb307d2adba59a2abab4a298e4d55" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Thu Jun 11 11:27:39 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jun 16 17:31:06 2026" }, "message": "tests: Add mixed concurrent EPPKE and IEEE 802.1X tests\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "6183590a5a9eb307d2adba59a2abab4a298e4d55", "tree": "784b7fb8eb6177643cad05eb2b45ebe62f89b703", "parents": [ "96ea8e57437e123ff34b3af81eb74acf4d33f27d" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Thu Jun 11 11:27:38 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jun 16 17:29:49 2026" }, "message": "ENC_ASSOC: Ensure group init for assoc-encrypted auth-frame STAs\n\nFor STAs that use association frame encryption with a Key Delivery\nelement, the WPA state machine skips the normal 4-way handshake path\n(SM_STATE AUTHENTICATION2). As a result, wpa_group_ensure_init() is not\ncalled and the GMK/GTK counters may remain uninitialized when such a STA\nis the first to connect.\n\nLater, when the first non-auth-frame STA associates, group key rotation\nis triggered and a new GTK is derived. The original auth-frame STA never\nsaw the initial GTK, so it cannot track the counter and fails to decrypt\nbroadcast/multicast frames.\n\nCall a new wpa_auth_ensure_group_init() helper before building the Key\nDelivery element for auth-frame STAs. This guarantees that the group\nstate is initialized early for both single-link and MLD cases, and is a\nno-op for already initialized groups, avoiding the broadcast breakage.\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "96ea8e57437e123ff34b3af81eb74acf4d33f27d", "tree": "0f82954425a49fbe82c93d3887d2fbb88cca4934", "parents": [ "6d0d62c4b3fd35af52cefa392b0d5c296223edeb" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Thu Jun 11 11:27:37 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jun 16 17:26:02 2026" }, "message": "tests: Extend IEEE 802.1X auth frame coverage\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "6d0d62c4b3fd35af52cefa392b0d5c296223edeb", "tree": "61fa6783c2e5d7f0a0e26d1dc4279aa6a02bc0b7", "parents": [ "8898446d272d29768b078d0c0624851ee0cbd1c4" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Thu Jun 11 11:27:36 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jun 16 17:20:32 2026" }, "message": "tests: Add auth_alg checks to all IEEE 802.1X auth frame test cases\n\nVerify that the auth_alg field reported by hostapd for each connected\nstation matches the expected authentication algorithm after a successful\nIEEE 802.1X Authentication frame exchange.\n\nFor test cases using eap_over_auth_frame\u003d1 with a capable AKM\n(WPA-EAP-SHA256, WPA-EAP-SHA384, WPA-EAP-SUITE-B-192), the expected\nvalue is WLAN_AUTH_802_1X (8). For the legacy WPA-EAP (AKM suite 1) test\ncase, the expected value is WLAN_AUTH_OPEN (0) since wpa_supplicant\nfalls back to Open System authentication.\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "8898446d272d29768b078d0c0624851ee0cbd1c4", "tree": "3af00128ed65484a584f4834c5d2c10d68a9177d", "parents": [ "e63ee36287fe679ea0860f444f126f823d316d68" ], "author": { "name": "Kavita Kavita", "email": "kavita.kavita@oss.qualcomm.com", "time": "Thu Jun 11 11:27:35 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jun 16 17:19:51 2026" }, "message": "tests: Add connectivity check to IEEE 802.1X Authentication test cases\n\nSigned-off-by: Kavita Kavita \u003ckavita.kavita@oss.qualcomm.com\u003e\n" }, { "commit": "e63ee36287fe679ea0860f444f126f823d316d68", "tree": "77be5e8a278460ff9d4ea56f9e0566344edd1aba", "parents": [ "252935ef505aee0772b79f3c67523e0ce9050a5c" ], "author": { "name": "Kavita Kavita", "email": "kavita.kavita@oss.qualcomm.com", "time": "Thu Jun 11 11:27:34 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jun 16 17:19:01 2026" }, "message": "tests: Add connectivity check to EPPKE test cases\n\nSigned-off-by: Kavita Kavita \u003ckavita.kavita@oss.qualcomm.com\u003e\n" }, { "commit": "252935ef505aee0772b79f3c67523e0ce9050a5c", "tree": "2e2c77c6a199e98213101751234dc7e10f079038", "parents": [ "ddce2340be5a9490644b28b2955a8092fbe3861a" ], "author": { "name": "Kavita Kavita", "email": "kavita.kavita@oss.qualcomm.com", "time": "Thu Jun 11 11:27:33 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jun 16 17:11:21 2026" }, "message": "ENC_ASSOC: Fix MLO GTK installation in process_key_delivery_link()\n\nThe GTK copy in process_key_delivery_link() used an incorrect offset:\n\n os_memcpy(gd.gtk, rsc + 1 + rsc_len, gd.gtk_len);\n\nThe extra offset caused one byte of GTK material to be skipped. As a\nresult, incorrect GTK is installed to the driver.\n\nThe function also duplicated the MLO GTK parsing and installation logic\nthat is already handled by wpa_supplicant_mlo_gtk(). Reuse existing APIs\nto install the MLO GTK to the driver to avoid duplication of the code\nand fix it.\n\nFixes: 018876793093 (\"EPPKE: Handle encrypted (Re)Association Response frame\")\nSigned-off-by: Kavita Kavita \u003ckavita.kavita@oss.qualcomm.com\u003e\n" }, { "commit": "ddce2340be5a9490644b28b2955a8092fbe3861a", "tree": "3a0c482992cfe96e08e02249da338e5e5525dcac", "parents": [ "d595bf6946c1c9bb0546816b0520dc12db4ea5b5" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Thu Jun 11 11:27:32 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jun 16 09:04:38 2026" }, "message": "nl80211: Propagate assoc_encrypted flag in QCA roam auth event\n\nPass QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_ASSOC_ENCRYPTED to\nwpa_supplicant_event() instead of using NULL so that the\nassociation-encrypted attribute is available for processing in\nQCA roam authentication events.\n\nThis allows userspace to correctly handle cases where the\n(roam) association frame is encrypted and the driver reports\nthis via the vendor attribute.\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "d595bf6946c1c9bb0546816b0520dc12db4ea5b5", "tree": "6e70318d54d3738ff227ee04a9f8aeee6a385da6", "parents": [ "aca4f523390d5e6533a989a65d6085f8a761c1ee" ], "author": { "name": "Kavita Kavita", "email": "kavita.kavita@oss.qualcomm.com", "time": "Thu Jun 11 11:27:31 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jun 16 09:02:33 2026" }, "message": "EPPKE: Fix PMKID written at wrong offset in wpa_external_auth_add_rsne()\n\nThe pos pointer was not advanced after writing the PMKID Count\nfield in wpa_external_auth_add_rsne(), causing the PMKID to\noverwrite the count field. Fix this by advancing pos by 2 after\nwriting the PMKID Count.\n\nFixes: f991c23abc0e (\"EPPKE: Build RSNE for EPPKE in SME-in-driver mode\")\nSigned-off-by: Kavita Kavita \u003ckavita.kavita@oss.qualcomm.com\u003e\n" }, { "commit": "aca4f523390d5e6533a989a65d6085f8a761c1ee", "tree": "db84058bf21efeaf9e65a370dfd868cfc12626f0", "parents": [ "4a1fd31ba249691a1591580a1dd2c5f4173569a3" ], "author": { "name": "Kavita Kavita", "email": "kavita.kavita@oss.qualcomm.com", "time": "Thu Jun 11 11:27:30 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jun 16 09:02:33 2026" }, "message": "PASN: Fix build failure when CONFIG_ENC_ASSOC is not enabled\n\nThe struct members auth_alg, group_cipher, and group_mgmt_cipher in\nwpa_pasn_auth_work were guarded by CONFIG_ENC_ASSOC, but these are\nused in wpas_pasn_auth_start_cb() regardless of the config.\n\nMove them out of the CONFIG_ENC_ASSOC guard to fix the build failure.\n\nSigned-off-by: Kavita Kavita \u003ckavita.kavita@oss.qualcomm.com\u003e\n" }, { "commit": "4a1fd31ba249691a1591580a1dd2c5f4173569a3", "tree": "fe6080f79e08dcc9d54e3f635990cf8885df9440", "parents": [ "8bce436d50d22b04c4c7ad71a42c3306bb367620" ], "author": { "name": "Vamsi Krishna", "email": "vamsin@qti.qualcomm.com", "time": "Tue Jun 09 10:06:38 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Tue Jun 16 08:35:18 2026" }, "message": "Add QCA vendor interface to get TDLS events and statistics\n\nAdd QCA_NL80211_VENDOR_SUBCMD_TDLS_EVENT,\nQCA_NL80211_VENDOR_SUBCMD_TDLS_STATS, and\nQCA_NL80211_VENDOR_SUBCMD_TDLS_CONFIG to allow userspace to\nenable/disable TDLS statistics and events reporting and receive TDLS\nevents and statistics from the driver.\n\nSigned-off-by: Vamsi Krishna \u003cvamsin@qti.qualcomm.com\u003e\n" }, { "commit": "8bce436d50d22b04c4c7ad71a42c3306bb367620", "tree": "0a38916ff22fcf7cc2421ed78a6c9fd356e7eba4", "parents": [ "14f5b069a04c7f4851150d693e51b82e67bd5299" ], "author": { "name": "Harshitha Prem", "email": "harshitha.prem@oss.qualcomm.com", "time": "Thu Jun 11 11:23:32 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jun 15 14:31:24 2026" }, "message": "UHR: Fix Enhanced Critical Update field placement in Basic MLE\n\nIEEE P802.11bn/D1.5, Figure 9-1164 (Common Info field of the Basic\nMulti-Link element format) defines the new Enhanced Critical Updates\nInformation field to be after the AP MLD ID and Extended MLD\nCapabilities And Operations fields.\n\nThe Enhanced Critical Update Information field was incorrectly placed\nafter the BSS Parameters Change Count field before these other fields.\nMove it to its correct position: after the AP MLD ID (since we are not\ncurrently adding the Extended MLD Capabilities and Operations field) at\nthe end of the Common Info field.\n\nFixes: 479c22a21 (\"UHR: Include enhanced critical update field in MLE for UHR\")\nSigned-off-by: Harshitha Prem \u003charshitha.prem@oss.qualcomm.com\u003e\n" }, { "commit": "14f5b069a04c7f4851150d693e51b82e67bd5299", "tree": "75df36f3406f9edb18c7fd3b7037a1b439c3c1b2", "parents": [ "43ab00c07ec2c32818f9ed2ffc0c0c700bbc0876" ], "author": { "name": "gaolez", "email": "gaole.zhang@oss.qualcomm.com", "time": "Mon Jun 08 05:06:32 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jun 15 14:25:46 2026" }, "message": "wpa_supplicant: Enable MBO in defconfig by default\n\nWi-Fi Agile Multiband (MBO) is commonly deployed and provides useful\nfunctionality for many devices. Enable CONFIG_MBO in\nwpa_supplicant/defconfig so it is more likely to be built if this\ndocumentation file is used as a starting point for a project build\nconfiguration.\n\nSigned-off-by: Gaole Zhang \u003cgaole.zhang@oss.qualcomm.com\u003e\n" }, { "commit": "43ab00c07ec2c32818f9ed2ffc0c0c700bbc0876", "tree": "6eda69d601b43a88d8e00315d07be1543bb64038", "parents": [ "b332757e70d47875157a48d43eb34e451e817bd7" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Thu Jun 11 21:15:13 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jun 15 12:41:24 2026" }, "message": "PR: Fix memory leak and state lockup in wpas_pr_pasn_trigger()\n\nWhen pr_ensure_oob_peer() or pr_set_peer_credentials() fails after\npr-\u003epr_pasn_params has already been allocated and populated,\nwpas_pr_pasn_trigger() returned -1 directly without freeing\npr-\u003epr_pasn_params. This left pr-\u003epr_pasn_params non-NULL, causing all\nsubsequent calls to hit the \"Already in progress\" guard permanently,\nlocking the state machine.\n\nFix by calling wpas_pr_clear_ranging_params() before returning on this\nerror path, which frees pr-\u003epr_pasn_params and resets it to NULL.\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "b332757e70d47875157a48d43eb34e451e817bd7", "tree": "4a1daf5f8975c74140836676190baee6eefc5a0f", "parents": [ "00760f77483751a31e222b57b1966ac3757152ea" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Thu Jun 11 21:15:12 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jun 15 12:39:03 2026" }, "message": "PASN: Remove redundant wpabuf_free(auth1) in wpa_pasn_reset()\n\nCommit 5e5aba3dc8c5 (\"PASN: Calculate Auth1 hash after PTK derivation\")\nintroduced auth1 as a wpabuf to store a copy of Authentication frame 1,\nreplacing the old fixed-size hash array. It correctly added\nwpabuf_free(pasn-\u003eauth1) near the top of wpa_pasn_reset() alongside\nforced_memzero(\u0026pasn-\u003eptk, ...), but also added a second identical\nfree/NULL pair at the very end of the function after\nwpabuf_free(pasn-\u003eframe). Since pasn-\u003eauth1 is already NULL after the\nfirst free, the second call is a safe no-op but is dead code. Remove the\nredundant second instance.\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" }, { "commit": "00760f77483751a31e222b57b1966ac3757152ea", "tree": "e408a27eec7a3affaa896fdc6ef56cc2ec31e366", "parents": [ "d4638304acf87ebce02c630a2cbdbe234f5129ec" ], "author": { "name": "Jouni Malinen", "email": "jouni.malinen@oss.qualcomm.com", "time": "Mon Jun 15 12:32:41 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Mon Jun 15 12:32:41 2026" }, "message": "nl80211: Fix HE 6 GHz capability fetching\n\nOriginally, this used nla_get_u16() to a u16 variable and le_to_host16()\nfrom that variable. That results in a static analysis warning about byte\norder (le16 should have been used as the type and nla_get_u16() is\nsupposed to return the attribute value in host byte order). This was\nthen \"fixed\" by removing the call to le_to_host16() to get the types\nmatching normal nla_get_u16() uses. However, the attribute value is\nactually the payload of the HE 6 GHz Band Capabilities element, not a\nu16 integer. That element payload just happens to consists of a 16-bit\nfield that is in little endian byte order per IEEE 802.11 conventions.\n\nFix this by interpreting this attribute as variable length binary data\nand accept it as valid if it has a length of two or more octets.\nByte-swap the first two octets to produce the host byte order value for\nhe_capab-\u003ehe_6ghz_capa to match the initial implementation behavior.\n\nFixes: ff5248a8e91e (\"nl80211: Fix HE 6 GHz capability fetching on big-endian CPUs\")\nSigned-off-by: Jouni Malinen \u003cjouni.malinen@oss.qualcomm.com\u003e\n" }, { "commit": "d4638304acf87ebce02c630a2cbdbe234f5129ec", "tree": "c9e412c3f4d25c023e5615cb4394e85383a63ef5", "parents": [ "88cea983803d36a02c112314f544b839abb79560" ], "author": { "name": "Aishwarya R", "email": "aishwarya.r@oss.qualcomm.com", "time": "Tue May 12 05:24:57 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Sun Jun 14 14:56:18 2026" }, "message": "tests: Add AP DSCP policy hwsim tests\n\nAdd hwsim test cases to verify AP functionality for DSCP Policy\nmanagement. These tests validate the AP\u0027s capability to initiate\nand manage DSCP policies with connected stations using QoS\nManagement frames.\n\nSigned-off-by: Aishwarya R \u003caishwarya.r@oss.qualcomm.com\u003e\n" }, { "commit": "88cea983803d36a02c112314f544b839abb79560", "tree": "820169be840873f2eb67ea717ea86f27bf2f6d12", "parents": [ "35245b849a7fc4211a5817ec20de3790eca01fc3" ], "author": { "name": "Aishwarya R", "email": "aishwarya.r@oss.qualcomm.com", "time": "Tue May 12 05:24:56 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Sun Jun 14 14:56:18 2026" }, "message": "DSCP: Handle DSCP Policy Response frames from STA\n\nAdd support for parsing and processing DSCP Policy Response Action\nframes received from STAs.\n\nHandle the response control field, including reset and more bits. Parse\npolicy status duples and updating internal policy state. Add support for\nmarking policies as accepted, rejected, or invalidated based on the\nresponse status. Trigger additional policy requests if the STA indicates\nit can handle more policies.\n\nThis enables the AP to track the outcome of DSCP policy negotiations and\nrespond accordingly, as defined in the Wi-Fi QoS Management\nspecification.\n\nSigned-off-by: Aishwarya R \u003caishwarya.r@oss.qualcomm.com\u003e\n" }, { "commit": "35245b849a7fc4211a5817ec20de3790eca01fc3", "tree": "f249871db07087cf979c1394dda8d2cf13777147", "parents": [ "241f79bbcf7505f81317529992d9f7bfd8c9daf7" ], "author": { "name": "Aishwarya R", "email": "aishwarya.r@oss.qualcomm.com", "time": "Tue May 12 05:24:54 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Sun Jun 14 14:56:18 2026" }, "message": "DSCP: Parse policy queries and send solicitied request\n\nParse QoS Management elements to extract and validate query\nattributes(TCLAS Type 4, domain name, port range). Build internal query\nstructures and normalize Type 4 classifier parameters for IPv4/IPv6.\n\nImplement query parsing for one or more QoS Management elements,\nincluding wildcard query detection. Add policy-match logic to compare\nparsed queries against per-STA DSCP policies.\n\nConstruct and transmit DSCP Policy Request frames in response to valid\nSTA-initiated DSCP policy queries per Wi-Fi Alliance QoS Management\nspec. Support fragmentation and the More bit, and honor the DSCP reset\nflag.\n\nSigned-off-by: Aishwarya R \u003caishwarya.r@oss.qualcomm.com\u003e\n" }, { "commit": "241f79bbcf7505f81317529992d9f7bfd8c9daf7", "tree": "f1f4900091602b84142dc4b0ba85df05e722678e", "parents": [ "1d69431a51c7e318d6d0343a192f37528b2b919c" ], "author": { "name": "Aishwarya R", "email": "aishwarya.r@oss.qualcomm.com", "time": "Tue May 12 05:24:53 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Sun Jun 14 14:56:18 2026" }, "message": "DSCP: Building and sending Unsolicited DSCP policy request\n\nAdd support to construct and transmit unsolicited DSCP Policy Request\nframes to connected STAs. This includes:\n\nConstruction of a QoS Policy element for a given DSCP policy, including\nQoS management attributes like classifier, domain name, and port range.\n\nBuilding and sending one or more DSCP Policy Request frames to a STA,\nhandling fragmentation if the total size exceeds the maximum allowed.\n\nBatching multiple policies and setting the More bit when additional\nframes are needed.\n\nSigned-off-by: Aishwarya R \u003caishwarya.r@oss.qualcomm.com\u003e\n" }, { "commit": "1d69431a51c7e318d6d0343a192f37528b2b919c", "tree": "7f9f6a57dfcf3027f453111209a491de290c923f", "parents": [ "cd5c149a6f87f9e488ba1282ea80a50b8a923608" ], "author": { "name": "Aishwarya R", "email": "aishwarya.r@oss.qualcomm.com", "time": "Tue May 12 05:24:52 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Sun Jun 14 14:56:18 2026" }, "message": "DSCP: Allow DSCP policy to be attached to an associated STA\n\nIntroduce functionality to add a DSCP policy to an associated STA\nvia the hosyapd control interface. This includes:\n\nAdd a helper function add_dscp_policy_to_sta() that adds or updates a\nDSCP policy in the STA\u0027s policy list.\n\nMemory management for dynamically allocated policy entries.\n\nIntegrate the DSCP_POLICY control command to apply the parsed policy to\nthe target STA.\n\nSigned-off-by: Aishwarya R \u003caishwarya.r@oss.qualcomm.com\u003e\n" }, { "commit": "cd5c149a6f87f9e488ba1282ea80a50b8a923608", "tree": "be08d425fad68ad397f3a91aeb6ecd53fd8946b1", "parents": [ "60f2674a4e405d666004b604ae54ff8c89ec0c73" ], "author": { "name": "Aishwarya R", "email": "aishwarya.r@oss.qualcomm.com", "time": "Tue May 12 05:24:51 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Sun Jun 14 14:56:18 2026" }, "message": "DSCP: hostapd control interface for configuring DSCP policies\n\nIntroduce a new hostapd control interface command DSCP_POLICY to allow\nruntime configuration of DSCP policies for associated stations.\n\nAdd parsing logic for DSCP policy parameters including DSCP value,\nclassifier mask, IP version, IP addresses, ports, and domain name. Add\nsupport for both IPv4 and IPv6 classifiers.\n\nAdd support to validate input parameters and construction of frame\nclassifiers.\n\nAn example dscp_policy command usage:\n\nhostapd_cli -i \u003cwlanX\u003e dscp_policy \u003csta_addr\u003e \u003cpolicy_id\u003d\u003e\n\u003crequest_type\u003d\u003e \u003cdscp\u003d\u003e [classifier_mask\u003d] [ip_version\u003d] [src_ip\u003d]\n[dst_ip\u003d] [src_port\u003d] [dst_port\u003d] [protocol\u003d] [domain_name\u003d] [reset\u003d]\n\nSupported parameters:\n- policy_id\u003d\u003c0-255\u003e: Unique identifier for the DSCP policy\n- request_type\u003d\u003cadd/update/remove\u003e: Indicates whether to add, update\n or remove the policy\n- dscp\u003d\u003c0-63\u003e: DSCP value\n- classifier_mask\u003d\u003cbitmask\u003e: Specifies TCLAS fields to match\n- ip_version\u003d\u003c4/6\u003e: IP version for classifier\n- src_ip\u003d\u003cIPv4/IPv6 address\u003e: Source IP address\n- dst_ip\u003d\u003cIPv4/IPv6 address\u003e: Destination IP address\n- src_port\u003d\u003c0-65535\u003e: Source port\n- dst_port\u003d\u003c0-65535\u003e: Destination port (mutually exclusive with dst_port)\n- start_port\u003d\u003c0-65535\u003e: Start of port range\n- end_port\u003d\u003c0-65535\u003e: End of port range\n- protocol\u003d\u003c0-255\u003e: Transport protocol\n- domain_name\u003d\u003cstring\u003e: domain name (max 255 characters)\n- reset\u003d\u003c0|1\u003e: Flag to reset DSCP policy for the station\n\nSigned-off-by: Aishwarya R \u003caishwarya.r@oss.qualcomm.com\u003e\n" }, { "commit": "60f2674a4e405d666004b604ae54ff8c89ec0c73", "tree": "ad8fe887c02d48350265bcd98fe7eb585ee71823", "parents": [ "081d4fddab41e28c524ca77b32872ccf6b587342" ], "author": { "name": "Aishwarya R", "email": "aishwarya.r@oss.qualcomm.com", "time": "Tue May 12 05:24:50 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Sun Jun 14 14:56:18 2026" }, "message": "DSCP: Advertise Wi-Fi Alliance Capabilities element in AP mode\n\nAdd support for advertising DSCP policy capabilities in Beacon,\nProbe Response, and (Re)Association Response frames.\n\nThis is controlled by a configuration option enable_dscp_policy_capa.\n\nWhen enabled, the AP includes the Wi-Fi Alliance Capabilities element\nindicating support for DSCP policy and unsolicited DSCP policy\ncapabilities, as defined by the Wi‑Fi QoS Management Specification v4.0,\nSection 3.4.\n\nSigned-off-by: Aishwarya R \u003caishwarya.r@oss.qualcomm.com\u003e\n" }, { "commit": "081d4fddab41e28c524ca77b32872ccf6b587342", "tree": "61bafcb6d5717ec7d256b6d4f9cc4b15bae92d73", "parents": [ "220bb242f6d44e2e4e8dbdd9312dea605ddecbb1" ], "author": { "name": "Aishwarya R", "email": "aishwarya.r@oss.qualcomm.com", "time": "Tue May 12 05:24:48 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Sun Jun 14 14:56:18 2026" }, "message": "DSCP: Policy capability configuration in AP mode\n\nIntroduce a new configuration parameter enable_dscp_policy_capa\nto allow enabling or disabling DSCP policy capability per BSS.\n\nThe DSCP policy capability is disabled by default. Add\nenable_dscp_policy_capa\u003d1 option in the configuration file to enable\nDSCP policy.\n\nSigned-off-by: Aishwarya R \u003caishwarya.r@oss.qualcomm.com\u003e\n" }, { "commit": "220bb242f6d44e2e4e8dbdd9312dea605ddecbb1", "tree": "2cc6bac091efe70812e1cf5d9bf33fb670a0e1d3", "parents": [ "7aad72490e330bf71d118c176427537f02b6c01e" ], "author": { "name": "Aishwarya R", "email": "aishwarya.r@oss.qualcomm.com", "time": "Tue May 12 05:24:49 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Sun Jun 14 14:56:18 2026" }, "message": "DSCP: Check STA capability for DSCP policy\n\nAdd robust_av.c with a helper to update STA DSCP Policy capability based\non the Wi-Fi Alliance Capabilities element. The\nhostapd_update_dscp_policy_capability() helper clears the stored\ncapability first, requires MFP to be enabled for the STA, and sets\nWLAN_STA_DSCP_POLICY when the DSCP Policy capability bit is present in\nthe received WFA capabilities data.\n\nAlso add CONFIG_ROBUST_AV build integration.\n\nSigned-off-by: Aishwarya R \u003caishwarya.r@oss.qualcomm.com\u003e\n" }, { "commit": "7aad72490e330bf71d118c176427537f02b6c01e", "tree": "982695a8cf938fe50e1d68690ee51b94d4b2e14c", "parents": [ "379dc9813d06dc2a00acfd38c5d0d37725fec02a" ], "author": { "name": "Andreas Westin", "email": "andrwe@axis.com", "time": "Thu May 07 08:57:24 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Sat Jun 06 14:36:31 2026" }, "message": "macsec_linux: Don\u0027t send NULL pointer to rtnl_link_delete\n\nIf rtnl_link_add fails hostapd will still set created_link to true\nand also if rtnl_link_macsec_alloc fails the link pointer will be NULL\nand this is passed to rtnl_link_delete which crashes.\n\nSigned-off-by: Andreas Westin \u003candrwe@axis.com\u003e\n" }, { "commit": "379dc9813d06dc2a00acfd38c5d0d37725fec02a", "tree": "c1dc7ed719bf52f5b0c6e86a7e856919efdfb272", "parents": [ "61bbcc69a976b828ecd203639bb2cc2b603c8831" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed May 06 09:11:22 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Sat Jun 06 14:32:14 2026" }, "message": "tests: ap_pmf: Fix an exception string format\n\nSince I ran into this while playing with the SW crypto code,\nfix the Exception string format to use f-strings, it\u0027s broken\nas is since it\u0027s missing parentheses.\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "61bbcc69a976b828ecd203639bb2cc2b603c8831", "tree": "c13525b6e3cb2d10ab0a3ea2aa7c3a3294ba1902", "parents": [ "8ab2fd6bda0e852103babd6a99cdb311bb12b765" ], "author": { "name": "Tamizh Chelvam Raja", "email": "tamizh.raja@oss.qualcomm.com", "time": "Fri May 22 05:44:02 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 18:03:25 2026" }, "message": "Add QCA vendor attribute to control 3-address multicast frames in WDS mode\n\nAdd QCA_WLAN_VENDOR_ATTR_CONFIG_ALLOW_3ADDR_MC vendor attribute to\ncontrol host driver handling of 3-address multicast frames in WDS mode.\nThe driver by default drop 3-address multicast frames in WDS mode.\n\nThis attribute enables or disables acceptance of 3-address multicast\nframes when operating in WDS mode.\n\nSigned-off-by: Tamizh Chelvam Raja \u003ctamizh.raja@oss.qualcomm.com\u003e\n" }, { "commit": "8ab2fd6bda0e852103babd6a99cdb311bb12b765", "tree": "c8bf6f161d735945fb16711540fa9c2a814086ea", "parents": [ "42b3f110dcfa3217c64b12d538bd87c31cd53dd1" ], "author": { "name": "Andrei Otcheretianski", "email": "andrei.otcheretianski@intel.com", "time": "Thu Jun 04 07:02:40 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 17:42:08 2026" }, "message": "NAN: Reject pairing when bootstrap is in progress\n\nDo not allow NAN pairing to proceed while a bootstrap exchange is\nstill in progress with the peer.\n\nSigned-off-by: Andrei Otcheretianski \u003candrei.otcheretianski@intel.com\u003e\n" }, { "commit": "42b3f110dcfa3217c64b12d538bd87c31cd53dd1", "tree": "85f6251faa6b0aa65c2499fb4ff75bac4346935b", "parents": [ "a71fe88be98d5f6e9cc7909757a89b70c0e246ca" ], "author": { "name": "Andrei Otcheretianski", "email": "andrei.otcheretianski@intel.com", "time": "Thu Jun 04 07:02:39 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 17:42:06 2026" }, "message": "tests: NAN: Add protected unicast follow-up after verification test\n\nAfter successful NAN pairing verification (NIRA validated, PASN with\ncached PMK), unicast follow-up messages shall be PMF protected with\nNM-TK. Add test_nan_prot_ucast_followup_after_verification which\nperforms pairing verification and then exchanges unicast follow-ups,\nverifying they are received successfully.\n\nSigned-off-by: Andrei Otcheretianski \u003candrei.otcheretianski@intel.com\u003e\n" }, { "commit": "a71fe88be98d5f6e9cc7909757a89b70c0e246ca", "tree": "3cf356bc85155b74ed7231a61ebc01651d540e9f", "parents": [ "a99899e959b1d970275cebdf45e2e8b40063aed1" ], "author": { "name": "Andrei Otcheretianski", "email": "andrei.otcheretianski@intel.com", "time": "Thu Jun 04 07:02:38 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 17:42:01 2026" }, "message": "NAN: Set CDW overwrite info\n\nUnlike other places in the Wi-Fi Aware spec, CDW info field defined in\nTable 80 doesn\u0027t allow using 0 as \"applies for all\". Set map_id values\nbased on the number of supported NAN radios.\n\nWhile at it remove a stale comment that is not valid anymore.\n\nSigned-off-by: Andrei Otcheretianski \u003candrei.otcheretianski@intel.com\u003e\n" }, { "commit": "a99899e959b1d970275cebdf45e2e8b40063aed1", "tree": "56f74bd006a16d0fed0dc8af4d87e14d4efa51ed", "parents": [ "56e7c95eef53eb9bf05c67ceeb8f4a8490fe759c" ], "author": { "name": "Andrei Otcheretianski", "email": "andrei.otcheretianski@intel.com", "time": "Thu Jun 04 07:02:37 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 17:35:31 2026" }, "message": "NAN: Set security required bit in SDEA\n\nIf the security is mandatory, publish SDFs should advertise\nsecurity_required bit in SDEA. Set this bit by default when CSIDs are\nspecified in NAN_PUBLISH command. In addition, add an explicit\nconfiguration parameter to allow open NDP connections even when CSIDs\nare configured for a service.\n\nSigned-off-by: Andrei Otcheretianski \u003candrei.otcheretianski@intel.com\u003e\n" }, { "commit": "56e7c95eef53eb9bf05c67ceeb8f4a8490fe759c", "tree": "d613f29953ba906d0ddf696b55bcf33b0d123e1d", "parents": [ "43406d61a9bd9a4f6c44270f5c56d6faba7ff489" ], "author": { "name": "Andrei Otcheretianski", "email": "andrei.otcheretianski@intel.com", "time": "Thu Jun 04 07:01:11 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 17:34:08 2026" }, "message": "tests: NAN: Add counter-proposal with conditional availability test\n\nVerify NDP setup succeeds when peer sends conditional entries in its\ncounter-proposal.\n\nSigned-off-by: Andrei Otcheretianski \u003candrei.otcheretianski@intel.com\u003e\n" }, { "commit": "43406d61a9bd9a4f6c44270f5c56d6faba7ff489", "tree": "b5364b3224873102d81815e2cc364a677411abf4", "parents": [ "80d71bf587d80cd0b3f0f12429a9f5873bd81b4e" ], "author": { "name": "Andrei Otcheretianski", "email": "andrei.otcheretianski@intel.com", "time": "Thu Jun 04 07:01:10 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 17:33:33 2026" }, "message": "NAN: Add force_conditional_sched testing option\n\nAllow forcing NDP schedule to use conditional time bitmap instead of\ncommitted for testing purposes.\n\nSigned-off-by: Andrei Otcheretianski \u003candrei.otcheretianski@intel.com\u003e\n" }, { "commit": "80d71bf587d80cd0b3f0f12429a9f5873bd81b4e", "tree": "5742cac6abc07c16a787d5bb1d2ca91d22de2a3a", "parents": [ "ced431f4ed706b3d593aab3dff00758c7bb08af4" ], "author": { "name": "Andrei Otcheretianski", "email": "andrei.otcheretianski@intel.com", "time": "Thu Jun 04 07:01:09 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 17:24:05 2026" }, "message": "NAN: Fix nan_get_peer_ndc_freq() with conditional schedule\n\nnan_get_peer_ndc_freq() skipped non-committed channels when looking for\nNDC frequency, causing NDP setup failure after counter-proposal with\nconditional entries. Fix it.\n\nSigned-off-by: Andrei Otcheretianski \u003candrei.otcheretianski@intel.com\u003e\n" }, { "commit": "ced431f4ed706b3d593aab3dff00758c7bb08af4", "tree": "a53f8a88e6e81cba80787ef0e5fbbd419ab71f96", "parents": [ "ad488b8298994e28b140afeb11ae326eb2387b54" ], "author": { "name": "Andrei Otcheretianski", "email": "andrei.otcheretianski@intel.com", "time": "Thu Jun 04 07:01:08 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 17:24:05 2026" }, "message": "NAN: Set pri_chan_bm for conditional availability entries\n\nConditional availability entries were sent with pri_chan_bm\u003d0, causing\nthe receiver to drop them for op_class \u003e\u003d 128.\n\nSigned-off-by: Andrei Otcheretianski \u003candrei.otcheretianski@intel.com\u003e\n" }, { "commit": "ad488b8298994e28b140afeb11ae326eb2387b54", "tree": "64a8618b14a61facf4b63a79940ca4b43dc8fe57", "parents": [ "1cf4a533c9bb606d1cb63c2459834015d6759e85" ], "author": { "name": "Gustavo Bertoli", "email": "gubertoli@gmail.com", "time": "Mon Jun 01 21:46:41 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 17:22:11 2026" }, "message": "tests: Add hwsim test for DPP provisioning with hidden SSID\n\nSigned-off-by: Gustavo Bertoli \u003cgubertoli@gmail.com\u003e\n" }, { "commit": "1cf4a533c9bb606d1cb63c2459834015d6759e85", "tree": "10f380005cf84a80da5e81dc9384bb29c9985263", "parents": [ "ced424c98a688bba50267e1e9322a6ac0fe5721e" ], "author": { "name": "Gustavo Bertoli", "email": "gubertoli@gmail.com", "time": "Mon Jun 01 21:46:40 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 17:16:34 2026" }, "message": "DPP: Fix association with hidden SSID via directed probing\n\nWhen a station receives a DPP Configuration Object and the AP\u0027s\nSSID is hidden (ignore_broadcast_ssid\u003d1), the auto-provisioned\nnetwork never associates. The DPP handshake completes successfully\nand the Config Object is accepted, but wpa_supplicant subsequently\ntriggers a passive scan. Because the AP does not respond to wildcard\nProbe Requests, no matching network is found and the session sits\nsilently disconnected.\n\nLog shows the handshake succeeding without any subsequent SME\nauthentication attempts:\n\nwlan1: DPP-CONF-RECEIVED\nwlan1: DPP-CONFOBJ-AKM sae\nwlan1: DPP-CONFOBJ-SSID DPP\nwlan1: DPP-NETWORK-ID 0\nwlan1: DPP-TX dst\u003d... type\u003d11\n\nwpas_dpp_add_network() leaves ssid-\u003escan_ssid\u003d0. The DPP enrollee\nreceives the SSID through an authenticated channel (the DPP Config\nObject) and already knows the exact target SSID.\n\nSet scan_ssid\u003d1 only when the provisioned SSID is not visible in the BSS\nscan cache. A hidden AP advertises an empty SSID in Beacon frames, so\nwpa_bss_get() finds no matching entry - enabling directed probing only\nwhen actually required. Broadcast SSIDs found in scan results keep\nscan_ssid\u003d0, avoiding unnecessary directed probes that would impact\nprivacy.\n\nSigned-off-by: Gustavo Bertoli \u003cgubertoli@gmail.com\u003e\n" }, { "commit": "ced424c98a688bba50267e1e9322a6ac0fe5721e", "tree": "9708b192cbad60edbad1eb280022f2425bf51bca", "parents": [ "a4a150b60ebf299d6a86a3183b25c7250acb10d4" ], "author": { "name": "Wu Gao", "email": "wugao@qti.qualcomm.com", "time": "Fri May 29 06:16:54 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 16:58:06 2026" }, "message": "Add QCA_NL80211_VENDOR_SUBCMD_N79_COEX\n\nIntroduce a new vendor subcommand and attributes for N79 coexistence\nconfiguration. This command allows callers to set or get the N79\nactive/inactive state via QCA_WLAN_VENDOR_ATTR_N79_COEX_OP_TYPE. The\nWLAN host internally manages NSS/chain reduction, AP coordination, and\nhysteresis timers.\n\nNew additions:\n- QCA_NL80211_VENDOR_SUBCMD_N79_COEX\n- enum qca_wlan_vendor_attr_n79_coex_op (SET/GET operation type)\n- enum qca_wlan_vendor_attr_n79_coex\n- QCA_WLAN_VENDOR_ATTR_N79_COEX_OP_TYPE (u8: 0\u003dset, 1\u003dget)\n- QCA_WLAN_VENDOR_ATTR_N79_COEX_STATE (u8: 0\u003dinactive, 1\u003dactive)\n\nSigned-off-by: Wu Gao \u003cwugao@qti.qualcomm.com\u003e\n" }, { "commit": "a4a150b60ebf299d6a86a3183b25c7250acb10d4", "tree": "a0ef1cd33adcf51613c12b5c0baf69ce654daa27", "parents": [ "15e692c8352823d86b67415ce7c3bc90197746df" ], "author": { "name": "Gururaj Pandurangi", "email": "panduran@qti.qualcomm.com", "time": "Wed May 20 07:42:24 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 13:20:15 2026" }, "message": "Add QCA vendor subcommand to configure GVP operation parameters\n\nAdd a vendor subcommand to configure GVP operation parameters such as\nExclusion Zone entry/exit indication, GVP TX power limit, channel\nattributes like channel avoid start and end frequencies, and GVP\noperation start/stop indication.\n\nSigned-off-by: Gururaj Pandurangi \u003cpanduran@qti.qualcomm.com\u003e\n" }, { "commit": "15e692c8352823d86b67415ce7c3bc90197746df", "tree": "ea13a9df51c3bee769e49b82cfa7deeb2fd7113e", "parents": [ "b4011bcf9cb57bc0a5c406753539b3d18a2c3c20" ], "author": { "name": "Aishwarya R", "email": "aishwarya.r@oss.qualcomm.com", "time": "Mon Jun 01 05:14:13 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 13:08:20 2026" }, "message": "Add QCA vendor attribute for dynamic VLAN configuration\n\nAdd QCA_WLAN_VENDOR_ATTR_CONFIG_DYNAMIC_VLAN to the QCA vendor attribute\nenum. This attribute is used in AP mode only for the AP_VLAN dynamic\nVLAN case. Userspace sets this explicitly when per-station AP_VLAN\nhandling is enabled so the driver can allocate the required resources\nand switch AP_VLAN multicast packets to the TQM bypass datapath.\n\nThis is not enabled by default in the driver. When disabled, hardware\nencryption for this AP_VLAN case remains off and packets continue to use\nsoftware encryption instead. This is intended for cases where different\nVLAN instances require separate GTK handling.\n\nSigned-off-by: Aishwarya R \u003caishwarya.r@oss.qualcomm.com\u003e\n" }, { "commit": "b4011bcf9cb57bc0a5c406753539b3d18a2c3c20", "tree": "8eda36506300faa284a2cc95b359631e4ea2a8b1", "parents": [ "8944f8c845a4abd9b8c349f2c6e9d99f22a339c0" ], "author": { "name": "Veerendranath Jakkam", "email": "vjakkam@qti.qualcomm.com", "time": "Sun May 31 08:34:56 2026" }, "committer": { "name": "Jouni Malinen", "email": "j@w1.fi", "time": "Fri Jun 05 13:05:50 2026" }, "message": "Add QCA vendor roam auth flag for encrypted association frames\n\nAdd QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_ASSOC_ENCRYPTED to the roam\nauthentication vendor attributes. This flag allows the driver to\nindicate that the (Re)Association Request and the corresponding\n(Re)Association Response frames were transmitted encrypted over the air,\nas required by Enhanced Privacy Protection (EPP) defined in IEEE\nP802.11bi/D5.0.\n\nSigned-off-by: Veerendranath Jakkam \u003cvjakkam@qti.qualcomm.com\u003e\n" } ], "next": "8944f8c845a4abd9b8c349f2c6e9d99f22a339c0" }