A failed MLO link update can leave the interface with the requested dormant-links bitmap instead of its previous one. This can disable active links or trigger a bitmap warning during rollback. The error path restores the old valid-links bitmap but passes the new dormant_links argument to ieee80211_set_vif_links_bitmaps(). Save the old dormant bitmap before changing link state and use it when restoring the old configuration. LLM assistance was used to find the bug and review. Fixes: 6d543b34dbcf ("wifi: mac80211: Support disabled links during association") Cc: stable@vger.kernel.org Signed-off-by: Zhao Li --- Validation: A W=1 module build with MODPOST passed on top of the prerequisite patch. A QEMU guest forced duplicate-address rollback: the old code cleared dormant and active links, while this change preserved dormant=0x2 and active=0x1 without a warning. The driver-failure path was not run. A reproducer is available on request. Sparse C=2 passed. Targeted Smatch introduced no new diagnostics. Depends on "wifi: mac80211: fix use-after-free when MLO link setup is rolled back", Message-ID <20261026152654.80697-1-enderaoelyther@gmail.com>. net/mac80211/link.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mac80211/link.c b/net/mac80211/link.c index fac5a8c22596..41c1ae52e097 100644 --- a/net/mac80211/link.c +++ b/net/mac80211/link.c @@ -290,6 +290,7 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata, { u16 old_links = sdata->vif.valid_links; u16 old_active = sdata->vif.active_links; + u16 old_dormant = sdata->vif.dormant_links; unsigned long add = new_links & ~old_links; unsigned long rem = old_links & ~new_links; unsigned long sta_rem = rem; @@ -399,7 +400,7 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata, /* restore config */ memcpy(sdata->link, old_data, sizeof(old_data)); memcpy(sdata->vif.link_conf, old, sizeof(old)); - ieee80211_set_vif_links_bitmaps(sdata, old_links, dormant_links); + ieee80211_set_vif_links_bitmaps(sdata, old_links, old_dormant); /* drain RCU readers before cancelling work they may queue */ synchronize_rcu(); for_each_set_bit(link_id, &add, IEEE80211_MLD_MAX_NUM_LINKS) { base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4 prerequisite-patch-id: f3df0cde74cce63ac37decd81c2613cdb13f49ff -- 2.56.0