From: Benjamin Berg The Link ID Info field in the Reconfiguration Status Duple subfield of the Reconfiguration Response frame only uses the lower four bits for the link ID. The upper bits are reserved and should therefore be ignored. Fixes: 529766edcdbd ("wifi: mac80211: Support dynamic link addition and removal") Signed-off-by: Benjamin Berg Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit --- net/mac80211/mlme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index b72345c779c0..fe9283fc413e 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -10243,7 +10243,7 @@ void ieee80211_process_ml_reconf_resp(struct ieee80211_sub_if_data *sdata, for (i = 0; i < mgmt->u.action.u.ml_reconf_resp.count; i++) { u16 status = get_unaligned_le16(pos + 1); - link_id = *pos; + link_id = u8_get_bits(*pos, 0xf); if (!(link_mask & BIT(link_id))) { sdata_info(sdata, -- 2.34.1