From: Benjamin Berg The Link ID Info field in the Reconfiguration Status Duple subfield of the Reconfiguration Response frame only uses the lower four bits for the link ID. The upper bits are reserved and should therefore be ignored. Fixes: 36e05b0b8390 ("wifi: mac80211: Support dynamic link addition and removal") Signed-off-by: Benjamin Berg Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit --- net/mac80211/mlme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- v2: added structs and macros, as required. v3: fixed the Fixes tag diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c index 173a60360a45..51a259aa8568 100644 --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -10471,7 +10471,7 @@ void ieee80211_process_ml_reconf_resp(struct ieee80211_sub_if_data *sdata, for (i = 0; i < mgmt->u.action.ml_reconf_resp.count; i++) { u16 status = get_unaligned_le16(pos + 1); - link_id = *pos; + link_id = u8_get_bits(*pos, 0xf); if (!(link_mask & BIT(link_id))) { sdata_info(sdata, -- 2.34.1