From: Jouni Malinen <j@w1.fi>
Date: Sat, 18 Oct 2025 09:34:28 +0000 (+0300)
Subject: AP MLD: Update partner link wpa_sm pointers more consistently
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0435c06fc27053d1d773e055168a34b6f41fea35;p=thirdparty%2Fhostap.git

AP MLD: Update partner link wpa_sm pointers more consistently

This case of calling wpa_auth_sta_deinit(sta->wpa_sm) was the only one
missing a call to clear_wpa_sm_for_each_partner_link(hapd, sta). Add
that call to make sure no stale sta->wpa_sm pointers are left behind.
For the case where the assoc_wpa_sm is used, the same setting is applied
to all partner links.

Fixes: 03cf2b60194f ("AP MLD: Never keep a per-link wpa_sm")
Signed-off-by: Jouni Malinen <j@w1.fi>
---

diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
index 571507596..45106617d 100644
--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -4794,10 +4794,18 @@ out:
 		 * per-link instance.
 		 * This reference is needed during group rekey handling.
 		 */
-		if (resp == WLAN_STATUS_SUCCESS)
+		if (resp == WLAN_STATUS_SUCCESS) {
 			sta->wpa_sm = assoc_wpa_sm;
-		else
+#ifdef CONFIG_IEEE80211BE
+			set_wpa_sm_for_each_partner_link(hapd, sta,
+							 assoc_wpa_sm);
+#endif /* CONFIG_IEEE80211BE */
+		} else {
 			sta->wpa_sm = NULL;
+#ifdef CONFIG_IEEE80211BE
+			clear_wpa_sm_for_each_partner_link(hapd, sta);
+#endif /* CONFIG_IEEE80211BE */
+		}
 	}
 
 	return resp;
diff --git a/src/ap/sta_info.c b/src/ap/sta_info.c
index bf48747c6..bd5eed3dd 100644
--- a/src/ap/sta_info.c
+++ b/src/ap/sta_info.c
@@ -220,8 +220,9 @@ static void __ap_free_sta(struct hostapd_data *hapd, struct sta_info *sta)
 
 
 #ifdef CONFIG_IEEE80211BE
-void clear_wpa_sm_for_each_partner_link(struct hostapd_data *hapd,
-					struct sta_info *psta)
+
+void set_wpa_sm_for_each_partner_link(struct hostapd_data *hapd,
+				      struct sta_info *psta, void *wpa_sm)
 {
 	struct sta_info *lsta;
 	struct hostapd_data *lhapd;
@@ -235,9 +236,17 @@ void clear_wpa_sm_for_each_partner_link(struct hostapd_data *hapd,
 
 		lsta = ap_get_sta(lhapd, psta->addr);
 		if (lsta)
-			lsta->wpa_sm = NULL;
+			lsta->wpa_sm = wpa_sm;
 	}
 }
+
+
+void clear_wpa_sm_for_each_partner_link(struct hostapd_data *hapd,
+					struct sta_info *psta)
+{
+	set_wpa_sm_for_each_partner_link(hapd, psta, NULL);
+}
+
 #endif /* CONFIG_IEEE80211BE */
 
 
diff --git a/src/ap/sta_info.h b/src/ap/sta_info.h
index 6ed2930dd..bc7daa6a8 100644
--- a/src/ap/sta_info.h
+++ b/src/ap/sta_info.h
@@ -436,6 +436,8 @@ static inline void ap_sta_set_mld(struct sta_info *sta, bool mld)
 void ap_sta_free_sta_profile(struct mld_info *info);
 
 void hostapd_free_link_stas(struct hostapd_data *hapd);
+void set_wpa_sm_for_each_partner_link(struct hostapd_data *hapd,
+				      struct sta_info *psta, void *wpa_sm);
 void clear_wpa_sm_for_each_partner_link(struct hostapd_data *hapd,
 					struct sta_info *psta);