wifi: mac80211: avoid non-S1G AID fallback for S1G assoc

When assoc_data->s1g is set and no AID Response element is present,
falling back to mgmt->u.assoc_resp.aid reads the non-S1G
association-response layout.

Keep the fallback for non-S1G only. If a successful S1G association
response omits the AID Response element, abandon the association
instead of proceeding with AID 0. Initialize aid to 0 for other S1G
responses so the later mask and logging flow keeps a defined value
without reading the non-S1G layout.

Fixes: 2a8a6b7c4cb0 ("wifi: mac80211: handle station association response with S1G")
Assisted-by: Codex:gpt-5.5
Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260612152440.25955-2-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 9e92337bb6f9e5f3b17ef5f57f801c55ca817223..86c90b504cfd7aff849b65a43dbe2f1a35699017 100644 (file)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -7138,7 +7138,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 {
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
        struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
-       u16 capab_info, status_code, aid;
+       u16 capab_info, status_code, aid = 0;
        struct ieee80211_elems_parse_params parse_params = {
                .bss = NULL,
                .link_id = -1,
@@ -7217,8 +7217,10 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 
        if (elems->aid_resp)
                aid = le16_to_cpu(elems->aid_resp->aid);
-       else
+       else if (!assoc_data->s1g)
                aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
+       else if (status_code == WLAN_STATUS_SUCCESS)
+               goto abandon_assoc;
 
        /*
         * The 5 MSB of the AID field are reserved for a non-S1G STA. For