AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/08/01 19:22	flow	patch-triage	1m Args: null Results: { "EnableConfigs": [ "CFG80211", "MAC80211", "MAC80211_HWSIM" ], "FocusSymbols": [ "nl80211_remain_on_channel", "nl80211_tx_mgmt", "nl80211_probe_peer", "nl80211_tx_control_port", "cfg80211_mlme_mgmt_tx", "ieee80211_remain_on_channel", "ieee80211_mgmt_tx", "ieee80211_probe_peer", "ieee80211_tx_control_port", "ieee80211_attach_ack_skb", "ieee80211_start_roc_work" ], "Reasoning": "The patch changes how cookies are generated and passed for several nl80211 commands (remain_on_channel, tx_mgmt, probe_peer, tx_control_port). It modifies the core cfg80211 and mac80211 logic to generate cookies in nl80211 and pass them by value to drivers, instead of having drivers generate them and pass them back via pointers. This is a functional change to the core wireless stack and should be fuzzed.", "WorthFuzzing": true }
1/1	2026/08/01 19:22	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit db647f403d99a4369043df3c05eea5ddf840805d\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sat Aug 1 19:22:36 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c\nindex ecde91159b546..34025d64d6158 100644\n--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c\n+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c\n@@ -3034,20 +3034,14 @@ static int ath6kl_remain_on_channel(struct wiphy wiphy,\n \t\t\t\t struct wireless_dev wdev,\n \t\t\t\t struct ieee80211_channel chan,\n \t\t\t\t unsigned int duration,\n-\t\t\t\t u64 cookie, const u8 rx_addr)\n+\t\t\t\t u64 cookie, const u8 rx_addr)\n {\n \tstruct ath6kl_vif vif = ath6kl_vif_from_wdev(wdev);\n \tstruct ath6kl ar = ath6kl_priv(vif-\u003endev);\n-\tu32 id;\n \n \t/* TODO: if already pending or ongoing remain-on-channel,\n \t * return -EBUSY /\n-\tid = ++vif-\u003elast_roc_id;\n-\tif (id == 0) {\n-\t\t/ Do not use 0 as the cookie value /\n-\t\tid = ++vif-\u003elast_roc_id;\n-\t}\n-\tcookie = id;\n+\tvif-\u003elast_roc_id = cookie;\n \n \treturn ath6kl_wmi_remain_on_chnl_cmd(ar-\u003ewmi, vif-\u003efw_vif_idx,\n \t\t\t\t\t chan-\u003ecenter_freq, duration);\n@@ -3106,6 +3100,7 @@ static int ath6kl_send_go_probe_resp(struct ath6kl_vif vif,\n \n static bool ath6kl_mgmt_powersave_ap(struct ath6kl_vif vif,\n \t\t\t\t u32 id,\n+\t\t\t\t u64 cookie,\n \t\t\t\t u32 freq,\n \t\t\t\t u32 wait,\n \t\t\t\t const u8 buf,\n@@ -3138,6 +3133,7 @@ static bool ath6kl_mgmt_powersave_ap(struct ath6kl_vif vif,\n \n \t\t\tINIT_LIST_HEAD(\u0026mgmt_buf-\u003elist);\n \t\t\tmgmt_buf-\u003eid = id;\n+\t\t\tmgmt_buf-\u003ecookie = cookie;\n \t\t\tmgmt_buf-\u003efreq = freq;\n \t\t\tmgmt_buf-\u003ewait = wait;\n \t\t\tmgmt_buf-\u003elen = len;\n@@ -3190,7 +3186,7 @@ static bool ath6kl_is_p2p_go_ssid(const u8 buf, size_t len)\n }\n \n static int ath6kl_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n-\t\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n+\t\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n {\n \tstruct ath6kl_vif vif = ath6kl_vif_from_wdev(wdev);\n \tstruct ath6kl ar = ath6kl_priv(vif-\u003endev);\n@@ -3222,7 +3218,6 @@ static int ath6kl_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t * Send Probe Response frame in GO mode using a separate WMI\n \t\t * command to allow the target to fill in the generic IEs.\n \t\t /\n-\t\tcookie = 0; /* TX status not supported /\n \t\treturn ath6kl_send_go_probe_resp(vif, buf, len, freq);\n \t}\n \n@@ -3235,16 +3230,15 @@ static int ath6kl_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \t\tid = vif-\u003esend_action_id++;\n \t}\n \n-\tcookie = id;\n-\n \t/* AP mode Power saving processing /\n \tif (vif-\u003enw_type == AP_NETWORK) {\n-\t\tqueued = ath6kl_mgmt_powersave_ap(vif, id, freq, wait, buf, len,\n-\t\t\t\t\t\t \u0026more_data, no_cck);\n+\t\tqueued = ath6kl_mgmt_powersave_ap(vif, id, cookie, freq, wait,\n+\t\t\t\t\t\t buf, len, \u0026more_data, no_cck);\n \t\tif (queued)\n \t\t\treturn 0;\n \t}\n \n+\tar-\u003ewmi-\u003elast_mgmt_tx_cookie = cookie;\n \treturn ath6kl_wmi_send_mgmt_cmd(ar-\u003ewmi, vif-\u003efw_vif_idx, id, freq,\n \t\t\t\t\twait, buf, len, no_cck);\n }\ndiff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h\nindex 77e052336eb5b..a0b236eeeab54 100644\n--- a/drivers/net/wireless/ath/ath6kl/core.h\n+++ b/drivers/net/wireless/ath/ath6kl/core.h\n@@ -404,6 +404,7 @@ struct ath6kl_mgmt_buff {\n \tu32 freq;\n \tu32 wait;\n \tu32 id;\n+\tu64 cookie;\n \tbool no_cck;\n \tsize_t len;\n \tu8 buf[];\n@@ -631,8 +632,8 @@ struct ath6kl_vif {\n \tstruct cfg80211_scan_request scan_req;\n \tenum sme_state sme_state;\n \tint reconnect_flag;\n-\tu32 last_roc_id;\n-\tu32 last_cancel_roc_id;\n+\tu64 last_roc_id;\n+\tu64 last_cancel_roc_id;\n \tu32 send_action_id;\n \tbool probe_req_report;\n \tu16 assoc_bss_beacon_int;\ndiff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c\nindex 8afc6589fc51e..9c023d7ce3059 100644\n--- a/drivers/net/wireless/ath/ath6kl/main.c\n+++ b/drivers/net/wireless/ath/ath6kl/main.c\n@@ -898,6 +898,7 @@ void ath6kl_pspoll_event(struct ath6kl_vif vif, u8 aid)\n \t\tspin_unlock_bh(\u0026conn-\u003epsq_lock);\n \n \t\tconn-\u003esta_flags \|= STA_PS_POLLED;\n+\t\tar-\u003ewmi-\u003elast_mgmt_tx_cookie = mgmt_buf-\u003ecookie;\n \t\tath6kl_wmi_send_mgmt_cmd(ar-\u003ewmi, vif-\u003efw_vif_idx,\n \t\t\t\t\t mgmt_buf-\u003eid, mgmt_buf-\u003efreq,\n \t\t\t\t\t mgmt_buf-\u003ewait, mgmt_buf-\u003ebuf,\ndiff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c\nindex d818254139061..609d458ca6c57 100644\n--- a/drivers/net/wireless/ath/ath6kl/txrx.c\n+++ b/drivers/net/wireless/ath/ath6kl/txrx.c\n@@ -1469,6 +1469,7 @@ void ath6kl_rx(struct htc_target target, struct htc_packet packet)\n \t\t\t\t\tspin_unlock_bh(\u0026conn-\u003epsq_lock);\n \t\t\t\t\tidx = vif-\u003efw_vif_idx;\n \n+\t\t\t\t\tar-\u003ewmi-\u003elast_mgmt_tx_cookie = mgmt-\u003ecookie;\n \t\t\t\t\tath6kl_wmi_send_mgmt_cmd(ar-\u003ewmi,\n \t\t\t\t\t\t\t\t idx,\n \t\t\t\t\t\t\t\t mgmt-\u003eid,\ndiff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c\nindex 6c29f0bcec9f5..2140fddba8baf 100644\n--- a/drivers/net/wireless/ath/ath6kl/wmi.c\n+++ b/drivers/net/wireless/ath/ath6kl/wmi.c\n@@ -596,7 +596,7 @@ static int ath6kl_wmi_tx_status_event_rx(struct wmi wmi, u8 datap, int len,\n \tath6kl_dbg(ATH6KL_DBG_WMI, \"tx_status: id=%x ack_status=%u\\n\",\n \t\t id, ev-\u003eack_status);\n \tif (wmi-\u003elast_mgmt_tx_frame) {\n-\t\tcfg80211_mgmt_tx_status(\u0026vif-\u003ewdev, id,\n+\t\tcfg80211_mgmt_tx_status(\u0026vif-\u003ewdev, wmi-\u003elast_mgmt_tx_cookie,\n \t\t\t\t\twmi-\u003elast_mgmt_tx_frame,\n \t\t\t\t\twmi-\u003elast_mgmt_tx_frame_len,\n \t\t\t\t\t!!ev-\u003eack_status, GFP_ATOMIC);\ndiff --git a/drivers/net/wireless/ath/ath6kl/wmi.h b/drivers/net/wireless/ath/ath6kl/wmi.h\nindex 8fbece3fdad9f..89ce2abbb1cdc 100644\n--- a/drivers/net/wireless/ath/ath6kl/wmi.h\n+++ b/drivers/net/wireless/ath/ath6kl/wmi.h\n@@ -125,6 +125,7 @@ struct wmi {\n \n \tu8 last_mgmt_tx_frame;\n \tsize_t last_mgmt_tx_frame_len;\n+\tu64 last_mgmt_tx_cookie;\n \tu8 saved_pwr_mode;\n };\n \ndiff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c\nindex 5f2bd9a31faf6..9ac33d827f801 100644\n--- a/drivers/net/wireless/ath/wil6210/cfg80211.c\n+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c\n@@ -1432,7 +1432,7 @@ static int wil_cfg80211_set_wiphy_params(struct wiphy wiphy, int radio_idx,\n \n int wil_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t\t struct cfg80211_mgmt_tx_params params,\n-\t\t\t u64 cookie)\n+\t\t\t u64 cookie)\n {\n \tconst u8 buf = params-\u003ebuf;\n \tsize_t len = params-\u003elen;\n@@ -1488,8 +1488,7 @@ int wil_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \t /\n \ttx_status = (rc == 0);\n \trc = (rc == -EAGAIN) ? 0 : rc;\n-\tcfg80211_mgmt_tx_status(wdev, cookie ? cookie : 0, buf, len,\n-\t\t\t\ttx_status, GFP_KERNEL);\n+\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, tx_status, GFP_KERNEL);\n \n \treturn rc;\n }\n@@ -1735,7 +1734,7 @@ static int wil_remain_on_channel(struct wiphy wiphy,\n \t\t\t\t struct wireless_dev wdev,\n \t\t\t\t struct ieee80211_channel chan,\n \t\t\t\t unsigned int duration,\n-\t\t\t\t u64 cookie, const u8 rx_addr)\n+\t\t\t\t u64 cookie, const u8 rx_addr)\n {\n \tstruct wil6210_priv wil = wiphy_to_wil(wiphy);\n \tint rc;\n@@ -2381,7 +2380,7 @@ void wil_probe_client_flush(struct wil6210_vif vif)\n \n static int wil_cfg80211_probe_peer(struct wiphy wiphy,\n \t\t\t\t struct net_device dev,\n-\t\t\t\t const u8 peer, u64 cookie)\n+\t\t\t\t const u8 peer, u64 cookie)\n {\n \tstruct wil6210_priv wil = wiphy_to_wil(wiphy);\n \tstruct wil6210_vif vif = ndev_to_vif(dev);\n@@ -2399,13 +2398,12 @@ static int wil_cfg80211_probe_peer(struct wiphy wiphy,\n \t\treturn -ENOMEM;\n \n \treq-\u003ecid = cid;\n-\treq-\u003ecookie = cid;\n+\treq-\u003ecookie = cookie;\n \n \tmutex_lock(\u0026vif-\u003eprobe_client_mutex);\n \tlist_add_tail(\u0026req-\u003elist, \u0026vif-\u003eprobe_client_pending);\n \tmutex_unlock(\u0026vif-\u003eprobe_client_mutex);\n \n-\tcookie = req-\u003ecookie;\n \tqueue_work(wil-\u003ewq_service, \u0026vif-\u003eprobe_client_worker);\n \treturn 0;\n }\ndiff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c\nindex b8cb736a71852..e06e45323272c 100644\n--- a/drivers/net/wireless/ath/wil6210/debugfs.c\n+++ b/drivers/net/wireless/ath/wil6210/debugfs.c\n@@ -985,7 +985,7 @@ static ssize_t wil_write_file_txmgmt(struct file file, const char __user buf,\n \tparams.buf = frame;\n \tparams.len = len;\n \n-\trc = wil_cfg80211_mgmt_tx(wiphy, wdev, \u0026params, NULL);\n+\trc = wil_cfg80211_mgmt_tx(wiphy, wdev, \u0026params, 0);\n \n \tkfree(frame);\n \twil_info(wil, \"-\u003e %d\\n\", rc);\ndiff --git a/drivers/net/wireless/ath/wil6210/p2p.c b/drivers/net/wireless/ath/wil6210/p2p.c\nindex f20caf1a3905b..acd8a2e351032 100644\n--- a/drivers/net/wireless/ath/wil6210/p2p.c\n+++ b/drivers/net/wireless/ath/wil6210/p2p.c\n@@ -124,7 +124,7 @@ int wil_p2p_search(struct wil6210_vif vif,\n \n int wil_p2p_listen(struct wil6210_priv wil, struct wireless_dev wdev,\n \t\t unsigned int duration, struct ieee80211_channel chan,\n-\t\t u64 cookie)\n+\t\t u64 cookie)\n {\n \tstruct wil6210_vif vif = wdev_to_vif(wil, wdev);\n \tstruct wil_p2p_info p2p = \u0026vif-\u003ep2p;\n@@ -144,7 +144,7 @@ int wil_p2p_listen(struct wil6210_priv wil, struct wireless_dev wdev,\n \t}\n \n \tmemcpy(\u0026p2p-\u003elisten_chan, chan, sizeof(chan));\n-\tcookie = ++p2p-\u003ecookie;\n+\tp2p-\u003ecookie = cookie;\n \tp2p-\u003elisten_duration = duration;\n \n \tmutex_lock(\u0026wil-\u003evif_mutex);\n@@ -166,7 +166,7 @@ int wil_p2p_listen(struct wil6210_priv wil, struct wireless_dev wdev,\n \tif (vif-\u003emid == 0)\n \t\twil-\u003eradio_wdev = wdev;\n \n-\tcfg80211_ready_on_channel(wdev, cookie, chan, duration,\n+\tcfg80211_ready_on_channel(wdev, cookie, chan, duration,\n \t\t\t\t GFP_KERNEL);\n \n out:\ndiff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h\nindex 31e107c81e2d4..f8e60be631ca5 100644\n--- a/drivers/net/wireless/ath/wil6210/wil6210.h\n+++ b/drivers/net/wireless/ath/wil6210/wil6210.h\n@@ -1301,7 +1301,7 @@ int wil_p2p_search(struct wil6210_vif vif,\n \t\t struct cfg80211_scan_request request);\n int wil_p2p_listen(struct wil6210_priv wil, struct wireless_dev wdev,\n \t\t unsigned int duration, struct ieee80211_channel chan,\n-\t\t u64 cookie);\n+\t\t u64 cookie);\n u8 wil_p2p_stop_discovery(struct wil6210_vif vif);\n int wil_p2p_cancel_listen(struct wil6210_vif vif, u64 cookie);\n void wil_p2p_listen_expired(struct work_struct work);\n@@ -1317,7 +1317,7 @@ int wmi_stop_discovery(struct wil6210_vif vif);\n \n int wil_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t\t struct cfg80211_mgmt_tx_params params,\n-\t\t\t u64 cookie);\n+\t\t\t u64 cookie);\n void wil_cfg80211_ap_recovery(struct wil6210_priv wil);\n int wil_cfg80211_iface_combinations_from_fw(\n \tstruct wil6210_priv wil,\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\nindex 6b2c34e3a796c..872c48806d091 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\n@@ -5554,7 +5554,7 @@ brcmf_cfg80211_update_mgmt_frame_registrations(struct wiphy wiphy,\n \n int\n brcmf_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n-\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n+\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n {\n \tstruct brcmf_cfg80211_info cfg = wiphy_to_cfg(wiphy);\n \tstruct ieee80211_channel chan = params-\u003echan;\n@@ -5573,8 +5573,6 @@ brcmf_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \n \tbrcmf_dbg(TRACE, \"Enter\\n\");\n \n-\tcookie = 0;\n-\n \tmgmt = (const struct ieee80211_mgmt )buf;\n \n \tif (!ieee80211_is_mgmt(mgmt-\u003eframe_control)) {\n@@ -5605,7 +5603,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t\t\t\t BRCMF_VNDR_IE_PRBRSP_FLAG,\n \t\t\t\t\t \u0026buf[ie_offset],\n \t\t\t\t\t ie_len);\n-\t\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, true,\n+\t\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, true,\n \t\t\t\t\tGFP_KERNEL);\n \t} else if (ieee80211_is_action(mgmt-\u003eframe_control)) {\n \t\tif (len \u003e BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {\n@@ -5621,7 +5619,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t}\n \t\taction_frame = \u0026af_params-\u003eaction_frame;\n \t\t/* Add the packet Id /\n-\t\taction_frame-\u003epacket_id = cpu_to_le32(cookie);\n+\t\taction_frame-\u003epacket_id = cpu_to_le32(cookie);\n \t\t/* Add BSSID /\n \t\tmemcpy(\u0026action_frame-\u003eda[0], \u0026mgmt-\u003eda[0], ETH_ALEN);\n \t\tmemcpy(\u0026af_params-\u003ebssid[0], \u0026mgmt-\u003ebssid[0], ETH_ALEN);\n@@ -5649,12 +5647,12 @@ brcmf_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t le16_to_cpu(action_frame-\u003elen));\n \n \t\tbrcmf_dbg(TRACE, \"Action frame, cookie=%lld, len=%d, channel=%d\\n\",\n-\t\t\t cookie, le16_to_cpu(action_frame-\u003elen),\n+\t\t\t cookie, le16_to_cpu(action_frame-\u003elen),\n \t\t\t le32_to_cpu(af_params-\u003echannel));\n \n \t\tack = brcmf_p2p_send_action_frame(vif-\u003eifp, af_params);\n \n-\t\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, ack,\n+\t\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, ack,\n \t\t\t\t\tGFP_KERNEL);\n free:\n \t\tkfree(af_params);\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h\nindex 6ceb301429054..63e534523f518 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h\n@@ -497,6 +497,6 @@ void brcmf_cfg80211_free_vif(struct net_device ndev);\n \n int brcmf_set_wsec(struct brcmf_if ifp, const u8 key, u16 key_len, u16 flags);\n int brcmf_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n-\t\t\t struct cfg80211_mgmt_tx_params params, u64 cookie);\n+\t\t\t struct cfg80211_mgmt_tx_params params, u64 cookie);\n \n #endif / BRCMFMAC_CFG80211_H /\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c\nindex 873754be5174b..545eb9aae9660 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c\n@@ -100,7 +100,7 @@ static int brcmf_cyw_activate_events(struct brcmf_if ifp)\n \n static\n int brcmf_cyw_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n-\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n+\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n {\n \tstruct brcmf_cfg80211_info cfg = wiphy_to_cfg(wiphy);\n \tstruct ieee80211_channel chan = params-\u003echan;\n@@ -123,7 +123,6 @@ int brcmf_cyw_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \tif (!ieee80211_is_auth(mgmt-\u003eframe_control))\n \t\treturn brcmf_cfg80211_mgmt_tx(wiphy, wdev, params, cookie);\n \n-\tcookie = 0;\n \tvif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);\n \n \treinit_completion(\u0026vif-\u003emgmt_tx);\n@@ -155,7 +154,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \n \tmemcpy(\u0026mf_params-\u003eda[0], \u0026mgmt-\u003eda[0], ETH_ALEN);\n \tmemcpy(\u0026mf_params-\u003ebssid[0], \u0026mgmt-\u003ebssid[0], ETH_ALEN);\n-\tmf_params-\u003epacket_id = cpu_to_le32(cookie);\n+\tmf_params-\u003epacket_id = cpu_to_le32(cookie);\n \tmemcpy(mf_params-\u003edata, \u0026buf[DOT11_MGMT_HDR_LEN],\n \t le16_to_cpu(mf_params-\u003elen));\n \n@@ -187,8 +186,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \t}\n \n tx_status:\n-\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, ack,\n-\t\t\t\tGFP_KERNEL);\n+\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, ack, GFP_KERNEL);\n free:\n \tkfree(mf_params);\n \treturn err;\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c\nindex c7d7b35ab1253..32a015d6b7698 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c\n@@ -979,10 +979,8 @@ brcmf_p2p_discover_listen(struct brcmf_p2p_info p2p, u16 channel, u32 duration)\n \tp2p-\u003ecfg-\u003ed11inf.encchspec(\u0026ch);\n \terr = brcmf_p2p_set_discover_state(vif-\u003eifp, WL_P2P_DISC_ST_LISTEN,\n \t\t\t\t\t ch.chspec, (u16)duration);\n-\tif (!err) {\n+\tif (!err)\n \t\tset_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, \u0026p2p-\u003estatus);\n-\t\tp2p-\u003eremain_on_channel_cookie++;\n-\t}\n exit:\n \treturn err;\n }\n@@ -1000,7 +998,7 @@ brcmf_p2p_discover_listen(struct brcmf_p2p_info p2p, u16 channel, u32 duration)\n /\n int brcmf_p2p_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t\t\tstruct ieee80211_channel channel,\n-\t\t\t\tunsigned int duration, u64 cookie,\n+\t\t\t\tunsigned int duration, u64 cookie,\n \t\t\t\tconst u8 rx_addr)\n {\n \tstruct brcmf_cfg80211_info cfg = wiphy_to_cfg(wiphy);\n@@ -1020,8 +1018,8 @@ int brcmf_p2p_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev,\n \t\tgoto exit;\n \n \tmemcpy(\u0026p2p-\u003eremain_on_channel, channel, sizeof(channel));\n-\tcookie = p2p-\u003eremain_on_channel_cookie;\n-\tcfg80211_ready_on_channel(wdev, cookie, channel, duration, GFP_KERNEL);\n+\tp2p-\u003eremain_on_channel_cookie = cookie;\n+\tcfg80211_ready_on_channel(wdev, cookie, channel, duration, GFP_KERNEL);\n \n exit:\n \treturn err;\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h\nindex 9f3f01ade2b77..7078009491707 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h\n@@ -157,7 +157,7 @@ int brcmf_p2p_scan_prep(struct wiphy wiphy,\n \t\t\tstruct brcmf_cfg80211_vif vif);\n int brcmf_p2p_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t\t\tstruct ieee80211_channel channel,\n-\t\t\t\tunsigned int duration, u64 cookie,\n+\t\t\t\tunsigned int duration, u64 cookie,\n \t\t\t\tconst u8 rx_addr);\n int brcmf_p2p_notify_listen_complete(struct brcmf_if ifp,\n \t\t\t\t const struct brcmf_event_msg e,\ndiff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c\nindex 8ec2d22a8c33a..7a1ba32f1fb36 100644\n--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c\n+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c\n@@ -196,7 +196,7 @@ mwifiex_form_mgmt_frame(struct sk_buff skb, const u8 buf, size_t len)\n /\n static int\n mwifiex_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n-\t\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n+\t\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n {\n \tconst u8 buf = params-\u003ebuf;\n \tsize_t len = params-\u003elen;\n@@ -259,14 +259,13 @@ mwifiex_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \ttx_info-\u003epkt_len = pkt_len;\n \n \tmwifiex_form_mgmt_frame(skb, buf, len);\n-\tcookie = get_random_u32() \| 1;\n \n \tif (ieee80211_is_action(mgmt-\u003eframe_control))\n \t\tskb = mwifiex_clone_skb_for_tx_status(priv,\n \t\t\t\t\t\t skb,\n-\t\t\t\tMWIFIEX_BUF_FLAG_ACTION_TX_STATUS, cookie);\n+\t\t\t\tMWIFIEX_BUF_FLAG_ACTION_TX_STATUS, \u0026cookie);\n \telse\n-\t\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, true,\n+\t\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, true,\n \t\t\t\t\tGFP_ATOMIC);\n \n \tmwifiex_queue_tx_pkt(priv, skb);\n@@ -304,13 +303,13 @@ static int\n mwifiex_cfg80211_remain_on_channel(struct wiphy wiphy,\n \t\t\t\t struct wireless_dev wdev,\n \t\t\t\t struct ieee80211_channel chan,\n-\t\t\t\t unsigned int duration, u64 cookie,\n+\t\t\t\t unsigned int duration, u64 cookie,\n \t\t\t\t const u8 rx_addr)\n {\n \tstruct mwifiex_private priv = mwifiex_netdev_get_priv(wdev-\u003enetdev);\n \tint ret;\n \n-\tif (!chan \|\| !cookie) {\n+\tif (!chan) {\n \t\tmwifiex_dbg(priv-\u003eadapter, ERROR, \"Invalid parameter for ROC\\n\");\n \t\treturn -EINVAL;\n \t}\n@@ -326,15 +325,14 @@ mwifiex_cfg80211_remain_on_channel(struct wiphy wiphy,\n \t\t\t\t\t duration);\n \n \tif (!ret) {\n-\t\tcookie = get_random_u32() \| 1;\n-\t\tpriv-\u003eroc_cfg.cookie = cookie;\n+\t\tpriv-\u003eroc_cfg.cookie = cookie;\n \t\tpriv-\u003eroc_cfg.chan = chan;\n \n-\t\tcfg80211_ready_on_channel(wdev, cookie, chan,\n+\t\tcfg80211_ready_on_channel(wdev, cookie, chan,\n \t\t\t\t\t duration, GFP_ATOMIC);\n \n \t\tmwifiex_dbg(priv-\u003eadapter, INFO,\n-\t\t\t \"info: ROC, cookie = 0x%llx\\n\", cookie);\n+\t\t\t \"info: ROC, cookie = 0x%llx\\n\", cookie);\n \t}\n \n \treturn ret;\n@@ -4560,7 +4558,7 @@ mwifiex_cfg80211_disassociate(struct wiphy wiphy,\n static int\n mwifiex_cfg80211_probe_peer(struct wiphy wiphy,\n \t\t\t struct net_device dev, const u8 peer,\n-\t\t\t u64 cookie)\n+\t\t\t u64 cookie)\n {\n \t/ hostapd looks for NL80211_CMD_PROBE_CLIENT support; otherwise,\n \t * it requires monitor-mode support (which mwifiex doesn't support).\ndiff --git a/drivers/net/wireless/microchip/wilc1000/cfg80211.c b/drivers/net/wireless/microchip/wilc1000/cfg80211.c\nindex 6654fce4ded84..bb2748a193294 100644\n--- a/drivers/net/wireless/microchip/wilc1000/cfg80211.c\n+++ b/drivers/net/wireless/microchip/wilc1000/cfg80211.c\n@@ -1100,24 +1100,19 @@ static void wilc_wfi_remain_on_channel_expired(struct wilc_vif vif, u64 cookie)\n static int remain_on_channel(struct wiphy wiphy,\n \t\t\t struct wireless_dev wdev,\n \t\t\t struct ieee80211_channel chan,\n-\t\t\t unsigned int duration, u64 cookie,\n+\t\t\t unsigned int duration, u64 cookie,\n \t\t\t const u8 rx_addr)\n {\n \tint ret = 0;\n \tstruct wilc_vif vif = netdev_priv(wdev-\u003enetdev);\n \tstruct wilc_priv priv = \u0026vif-\u003epriv;\n-\tu64 id;\n \n \tif (wdev-\u003eiftype == NL80211_IFTYPE_AP) {\n \t\tnetdev_dbg(vif-\u003endev, \"Required while in AP mode\\n\");\n \t\treturn ret;\n \t}\n \n-\tid = ++priv-\u003einc_roc_cookie;\n-\tif (id == 0)\n-\t\tid = ++priv-\u003einc_roc_cookie;\n-\n-\tret = wilc_remain_on_channel(vif, id, chan-\u003ehw_value,\n+\tret = wilc_remain_on_channel(vif, cookie, chan-\u003ehw_value,\n \t\t\t\t wilc_wfi_remain_on_channel_expired);\n \tif (ret)\n \t\treturn ret;\n@@ -1125,12 +1120,11 @@ static int remain_on_channel(struct wiphy wiphy,\n \tvif-\u003ewilc-\u003eop_ch = chan-\u003ehw_value;\n \n \tpriv-\u003eremain_on_ch_params.listen_ch = chan;\n-\tpriv-\u003eremain_on_ch_params.listen_cookie = id;\n-\tcookie = id;\n+\tpriv-\u003eremain_on_ch_params.listen_cookie = cookie;\n \tpriv-\u003ep2p_listen_state = true;\n \tpriv-\u003eremain_on_ch_params.listen_duration = duration;\n \n-\tcfg80211_ready_on_channel(wdev, cookie, chan, duration, GFP_KERNEL);\n+\tcfg80211_ready_on_channel(wdev, cookie, chan, duration, GFP_KERNEL);\n \tmod_timer(\u0026vif-\u003ehif_drv-\u003eremain_on_ch_timer,\n \t\t jiffies + msecs_to_jiffies(duration + 1000));\n \n@@ -1153,7 +1147,7 @@ static int cancel_remain_on_channel(struct wiphy wiphy,\n static int mgmt_tx(struct wiphy wiphy,\n \t\t struct wireless_dev wdev,\n \t\t struct cfg80211_mgmt_tx_params params,\n-\t\t u64 cookie)\n+\t\t u64 cookie)\n {\n \tstruct ieee80211_channel chan = params-\u003echan;\n \tunsigned int wait = params-\u003ewait;\n@@ -1170,8 +1164,7 @@ static int mgmt_tx(struct wiphy wiphy,\n \tconst u8 vendor_ie;\n \tint ret = 0;\n \n-\tcookie = get_random_u32();\n-\tpriv-\u003etx_cookie = cookie;\n+\tpriv-\u003etx_cookie = cookie;\n \tmgmt = (const struct ieee80211_mgmt )buf;\n \n \tif (!ieee80211_is_mgmt(mgmt-\u003eframe_control))\ndiff --git a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c\nindex 4f9e20f728114..c820f08d28355 100644\n--- a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c\n+++ b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c\n@@ -150,7 +150,7 @@ nxpwifi_form_mgmt_frame(struct sk_buff skb, const u8 buf, size_t len)\n /* cfg80211 operation handler to transmit a management frame. /\n static int\n nxpwifi_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n-\t\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n+\t\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n {\n \tconst u8 buf = params-\u003ebuf;\n \tsize_t len = params-\u003elen;\n@@ -212,14 +212,13 @@ nxpwifi_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \ttx_info-\u003epkt_len = pkt_len;\n \n \tnxpwifi_form_mgmt_frame(skb, buf, len);\n-\tcookie = nxpwifi_roc_cookie(priv-\u003eadapter);\n \n \tif (ieee80211_is_action(mgmt-\u003eframe_control))\n \t\tskb = nxpwifi_clone_skb_for_tx_status(priv,\n \t\t\t\t\t\t skb,\n-\t\t\t\tNXPWIFI_BUF_FLAG_ACTION_TX_STATUS, cookie);\n+\t\t\t\tNXPWIFI_BUF_FLAG_ACTION_TX_STATUS, \u0026cookie);\n \telse\n-\t\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, true,\n+\t\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, true,\n \t\t\t\t\tGFP_ATOMIC);\n \n \tnxpwifi_queue_tx_pkt(priv, skb);\n@@ -254,14 +253,14 @@ static int\n nxpwifi_cfg80211_remain_on_channel(struct wiphy wiphy,\n \t\t\t\t struct wireless_dev wdev,\n \t\t\t\t struct ieee80211_channel chan,\n-\t\t\t\t unsigned int duration, u64 cookie,\n+\t\t\t\t unsigned int duration, u64 cookie,\n \t\t\t\t const u8 rx_addr)\n {\n \tstruct nxpwifi_private priv = nxpwifi_netdev_get_priv(wdev-\u003enetdev);\n \tstruct nxpwifi_adapter adapter = priv-\u003eadapter;\n \tint ret;\n \n-\tif (!chan \|\| !cookie) {\n+\tif (!chan) {\n \t\tnxpwifi_dbg(adapter, ERROR, \"Invalid parameter for ROC\\n\");\n \t\treturn -EINVAL;\n \t}\n@@ -277,15 +276,14 @@ nxpwifi_cfg80211_remain_on_channel(struct wiphy wiphy,\n \t\t\t\t\t duration);\n \n \tif (!ret) {\n-\t\tcookie = nxpwifi_roc_cookie(adapter);\n-\t\tpriv-\u003eroc_cfg.cookie = cookie;\n+\t\tpriv-\u003eroc_cfg.cookie = cookie;\n \t\tpriv-\u003eroc_cfg.chan = chan;\n \n-\t\tcfg80211_ready_on_channel(wdev, cookie, chan,\n+\t\tcfg80211_ready_on_channel(wdev, cookie, chan,\n \t\t\t\t\t duration, GFP_ATOMIC);\n \n \t\tnxpwifi_dbg(adapter, INFO,\n-\t\t\t \"info: ROC, cookie = 0x%llx\\n\", cookie);\n+\t\t\t \"info: ROC, cookie = 0x%llx\\n\", cookie);\n \t}\n \n \treturn ret;\n@@ -3618,7 +3616,7 @@ nxpwifi_cfg80211_disassociate(struct wiphy wiphy,\n static int\n nxpwifi_cfg80211_probe_peer(struct wiphy wiphy,\n \t\t\t struct net_device dev, const u8 peer,\n-\t\t\t u64 cookie)\n+\t\t\t u64 cookie)\n {\n \t/\n \t * hostapd looks for NL80211_CMD_PROBE_CLIENT support; otherwise,\ndiff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c\nindex 9e44c85d2051c..45e2b7ae96333 100644\n--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c\n+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c\n@@ -446,7 +446,7 @@ qtnf_update_mgmt_frame_registrations(struct wiphy wiphy,\n \n static int\n qtnf_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n-\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n+\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n {\n \tstruct qtnf_vif vif = qtnf_netdev_get_priv(wdev-\u003enetdev);\n \tconst struct ieee80211_mgmt mgmt_frame = (void )params-\u003ebuf;\n@@ -454,8 +454,6 @@ qtnf_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \tu16 flags = 0;\n \tu16 freq;\n \n-\tcookie = short_cookie;\n-\n \tif (params-\u003eoffchan)\n \t\tflags \|= QLINK_FRAME_TX_FLAG_OFFCHAN;\n \ndiff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c\nindex 6a97afd89dc78..b58dda129ff66 100644\n--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c\n+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c\n@@ -2530,7 +2530,7 @@ static int _cfg80211_rtw_mgmt_tx(struct adapter padapter, u8 tx_ch, const u8 b\n \n static int cfg80211_rtw_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t\t\tstruct cfg80211_mgmt_tx_params params,\n-\t\t\t\tu64 cookie)\n+\t\t\t\tu64 cookie)\n {\n \tstruct net_device ndev = wdev_to_ndev(wdev);\n \tstruct ieee80211_channel chan = params-\u003echan;\n@@ -2552,11 +2552,8 @@ static int cfg80211_rtw_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \n \tpadapter = rtw_netdev_priv(ndev);\n \n-\t/* cookie generation /\n-\tcookie = (unsigned long)buf;\n-\n \t/* indicate ack before issue frame to avoid racing with rsp frame /\n-\trtw_cfg80211_mgmt_tx_status(padapter, cookie, buf, len, ack, GFP_KERNEL);\n+\trtw_cfg80211_mgmt_tx_status(padapter, cookie, buf, len, ack, GFP_KERNEL);\n \n \tif (!rtw_action_frame_parse(buf, len, \u0026category, \u0026action))\n \t\tgoto exit;\ndiff --git a/include/net/cfg80211.h b/include/net/cfg80211.h\nindex dcbb0e55c32ec..97c16d4ff1271 100644\n--- a/include/net/cfg80211.h\n+++ b/include/net/cfg80211.h\n@@ -5108,7 +5108,8 @@ struct mgmt_frame_regs {\n * @tdls_oper: Perform a high-level TDLS operation (e.g. TDLS link setup).\n \n @probe_peer: probe a connected peer (AP: STA MAC required; STA: no MAC),\n- \tmust return a cookie that is later passed to cfg80211_probe_status().\n+ \tmust use the @cookie as provided which is later passed to\n+ \tcfg80211_probe_status().\n \n * @set_noack_map: Set the NoAck Map for the TIDs.\n \n@@ -5219,7 +5220,8 @@ struct mgmt_frame_regs {\n user space\n \n @tx_control_port: TX a control port frame (EAPoL). The noencrypt parameter\n- \ttells the driver that the frame should not be encrypted.\n+ \ttells the driver that the frame should not be encrypted. A @cookie\n+ \tvalue of 0 means the caller does not want TX status reporting.\n \n * @get_ftm_responder_stats: Retrieve FTM responder statistics, if available.\n \tStatistics should be cumulative, currently no way to reset is provided.\n@@ -5456,14 +5458,14 @@ struct cfg80211_ops {\n \t\t\t\t struct wireless_dev wdev,\n \t\t\t\t struct ieee80211_channel chan,\n \t\t\t\t unsigned int duration,\n-\t\t\t\t u64 cookie, const u8 rx_addr);\n+\t\t\t\t u64 cookie, const u8 rx_addr);\n \tint\t(cancel_remain_on_channel)(struct wiphy wiphy,\n \t\t\t\t\t struct wireless_dev wdev,\n \t\t\t\t\t u64 cookie);\n \n \tint\t(mgmt_tx)(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t\t struct cfg80211_mgmt_tx_params params,\n-\t\t\t u64 cookie);\n+\t\t\t u64 cookie);\n \tint\t(mgmt_tx_cancel_wait)(struct wiphy wiphy,\n \t\t\t\t struct wireless_dev wdev,\n \t\t\t\t u64 cookie);\n@@ -5510,7 +5512,7 @@ struct cfg80211_ops {\n \t\t\t const u8 peer, enum nl80211_tdls_operation oper);\n \n \tint\t(probe_peer)(struct wiphy wiphy, struct net_device dev,\n-\t\t\t const u8 peer, u64 cookie);\n+\t\t\t const u8 peer, u64 cookie);\n \n \tint\t(set_noack_map)(struct wiphy wiphy,\n \t\t\t\t struct net_device dev,\n@@ -5608,7 +5610,7 @@ struct cfg80211_ops {\n \t\t\t\t const u8 buf, size_t len,\n \t\t\t\t const u8 dest, const __be16 proto,\n \t\t\t\t const bool noencrypt, int link_id,\n-\t\t\t\t u64 cookie);\n+\t\t\t\t u64 cookie);\n \n \tint\t(get_ftm_responder_stats)(struct wiphy wiphy,\n \t\t\t\tstruct net_device dev,\ndiff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c\nindex 0a9247be26afa..0c2c7afd59c4a 100644\n--- a/net/mac80211/cfg.c\n+++ b/net/mac80211/cfg.c\n@@ -4831,19 +4831,6 @@ int ieee80211_channel_switch(struct wiphy wiphy, struct net_device dev,\n \treturn __ieee80211_channel_switch(wiphy, dev, params);\n }\n \n-u64 ieee80211_mgmt_tx_cookie(struct ieee80211_local local)\n-{\n-\tlockdep_assert_wiphy(local-\u003ehw.wiphy);\n-\n-\tlocal-\u003eroc_cookie_counter++;\n-\n-\t/* wow, you wrapped 64 bits ... more likely a bug /\n-\tif (WARN_ON(local-\u003eroc_cookie_counter == 0))\n-\t\tlocal-\u003eroc_cookie_counter++;\n-\n-\treturn local-\u003eroc_cookie_counter;\n-}\n-\n int ieee80211_attach_ack_skb(struct ieee80211_local local, struct sk_buff skb,\n \t\t\t u64 cookie, gfp_t gfp)\n {\n@@ -4868,7 +4855,6 @@ int ieee80211_attach_ack_skb(struct ieee80211_local local, struct sk_buff skb,\n \tIEEE80211_SKB_CB(skb)-\u003estatus_data_idr = 1;\n \tIEEE80211_SKB_CB(skb)-\u003estatus_data = id;\n \n-\tcookie = ieee80211_mgmt_tx_cookie(local);\n \tIEEE80211_SKB_CB(ack_skb)-\u003eack.cookie = cookie;\n \n \treturn 0;\n@@ -4954,7 +4940,7 @@ static int ieee80211_set_rekey_data(struct wiphy wiphy,\n }\n \n static int ieee80211_probe_peer(struct wiphy wiphy, struct net_device dev,\n-\t\t\t\tconst u8 peer, u64 cookie)\n+\t\t\t\tconst u8 peer, u64 cookie)\n {\n \tstruct ieee80211_sub_if_data sdata = IEEE80211_DEV_TO_SUB_IF(dev);\n \tstruct ieee80211_local local = sdata-\u003elocal;\n@@ -5061,7 +5047,7 @@ static int ieee80211_probe_peer(struct wiphy wiphy, struct net_device dev,\n \tif (qos)\n \t\tnullfunc-\u003eqos_ctrl = cpu_to_le16(7);\n \n-\tret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_ATOMIC);\n+\tret = ieee80211_attach_ack_skb(local, skb, \u0026cookie, GFP_ATOMIC);\n \tif (ret) {\n \t\tkfree_skb(skb);\n \t\treturn ret;\ndiff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h\nindex a1ef88fe846dd..5761e96214914 100644\n--- a/net/mac80211/ieee80211_i.h\n+++ b/net/mac80211/ieee80211_i.h\n@@ -1710,8 +1710,6 @@ struct ieee80211_local {\n \tstruct list_head roc_list;\n \tstruct wiphy_work hw_roc_start, hw_roc_done;\n \tunsigned long hw_roc_start_time;\n-\tu64 roc_cookie_counter;\n-\n \tstruct idr ack_status_frames;\n \tspinlock_t ack_status_lock;\n \n@@ -1991,7 +1989,6 @@ u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data sdata);\n \n void ieee80211_handle_queued_frames(struct ieee80211_local local);\n \n-u64 ieee80211_mgmt_tx_cookie(struct ieee80211_local local);\n int ieee80211_attach_ack_skb(struct ieee80211_local local, struct sk_buff skb,\n \t\t\t u64 cookie, gfp_t gfp);\n \n@@ -2153,12 +2150,12 @@ void ieee80211_roc_purge(struct ieee80211_local local,\n \t\t\t struct ieee80211_sub_if_data sdata);\n int ieee80211_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t\t\tstruct ieee80211_channel chan,\n-\t\t\t\tunsigned int duration, u64 cookie,\n+\t\t\t\tunsigned int duration, u64 cookie,\n \t\t\t\tconst u8 rx_addr);\n int ieee80211_cancel_remain_on_channel(struct wiphy wiphy,\n \t\t\t\t struct wireless_dev wdev, u64 cookie);\n int ieee80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n-\t\t struct cfg80211_mgmt_tx_params params, u64 cookie);\n+\t\t struct cfg80211_mgmt_tx_params params, u64 cookie);\n int ieee80211_mgmt_tx_cancel_wait(struct wiphy wiphy,\n \t\t\t\t struct wireless_dev wdev, u64 cookie);\n \n@@ -2237,7 +2234,7 @@ void __ieee80211_subif_start_xmit(struct sk_buff skb,\n \t\t\t\t struct net_device dev,\n \t\t\t\t u32 info_flags,\n \t\t\t\t u32 ctrl_flags,\n-\t\t\t\t u64 cookie);\n+\t\t\t\t u64 cookie);\n struct sk_buff \n ieee80211_build_data_template(struct ieee80211_sub_if_data sdata,\n \t\t\t struct sk_buff skb, u32 info_flags);\n@@ -2251,7 +2248,7 @@ void ieee80211_clear_fast_xmit(struct sta_info sta);\n int ieee80211_tx_control_port(struct wiphy wiphy, struct net_device dev,\n \t\t\t const u8 buf, size_t len,\n \t\t\t const u8 dest, __be16 proto, bool unencrypted,\n-\t\t\t int link_id, u64 cookie);\n+\t\t\t int link_id, u64 cookie);\n int ieee80211_probe_mesh_link(struct wiphy wiphy, struct net_device dev,\n \t\t\t const u8 buf, size_t len);\n void __ieee80211_xmit_fast(struct ieee80211_sub_if_data sdata,\ndiff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c\nindex 2bceb73717c66..7acef80d5f1fb 100644\n--- a/net/mac80211/offchannel.c\n+++ b/net/mac80211/offchannel.c\n@@ -602,14 +602,12 @@ static int ieee80211_start_roc_work(struct ieee80211_local local,\n \n \t/\n \t * cookie is either the roc cookie (for normal roc)\n-\t * or the SKB (for mgmt TX)\n+\t * or the mgmt_tx cookie; both are pre-assigned by cfg80211\n \t /\n-\tif (!txskb) {\n-\t\troc-\u003ecookie = ieee80211_mgmt_tx_cookie(local);\n-\t\tcookie = roc-\u003ecookie;\n-\t} else {\n+\tif (!txskb)\n+\t\troc-\u003ecookie = cookie;\n+\telse\n \t\troc-\u003emgmt_tx_cookie = cookie;\n-\t}\n \n \treq = wiphy_dereference(local-\u003ehw.wiphy, local-\u003escan_req);\n \n@@ -704,7 +702,7 @@ static int ieee80211_start_roc_work(struct ieee80211_local local,\n \n int ieee80211_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t\t\tstruct ieee80211_channel chan,\n-\t\t\t\tunsigned int duration, u64 cookie,\n+\t\t\t\tunsigned int duration, u64 cookie,\n \t\t\t\tconst u8 rx_addr)\n {\n \tstruct ieee80211_sub_if_data sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);\n@@ -713,7 +711,7 @@ int ieee80211_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev,\n \tlockdep_assert_wiphy(local-\u003ehw.wiphy);\n \n \treturn ieee80211_start_roc_work(local, sdata, chan,\n-\t\t\t\t\tduration, cookie, NULL,\n+\t\t\t\t\tduration, \u0026cookie, NULL,\n \t\t\t\t\tIEEE80211_ROC_TYPE_NORMAL);\n }\n \n@@ -810,7 +808,7 @@ int ieee80211_cancel_remain_on_channel(struct wiphy wiphy,\n }\n \n int ieee80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n-\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n+\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n {\n \tstruct ieee80211_sub_if_data sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);\n \tstruct ieee80211_local local = sdata-\u003elocal;\n@@ -1016,18 +1014,11 @@ int ieee80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \t\t/ make a copy to preserve the frame contents\n \t\t * in case of encryption.\n \t\t /\n-\t\tret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_KERNEL);\n+\t\tret = ieee80211_attach_ack_skb(local, skb, \u0026cookie, GFP_KERNEL);\n \t\tif (ret) {\n \t\t\tkfree_skb(skb);\n \t\t\tgoto out_unlock;\n \t\t}\n-\t} else {\n-\t\t/ Assign a dummy non-zero cookie, it's not sent to\n-\t\t * userspace in this case but we rely on its value\n-\t\t * internally in the need_offchan case to distinguish\n-\t\t * mgmt-tx from remain-on-channel.\n-\t\t /\n-\t\tcookie = 0xffffffff;\n \t}\n \n \tif (!need_offchan) {\n@@ -1044,7 +1035,7 @@ int ieee80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\n \n \t/* This will handle all kinds of coalescing and immediate TX /\n \tret = ieee80211_start_roc_work(local, sdata, params-\u003echan,\n-\t\t\t\t params-\u003ewait, cookie, skb,\n+\t\t\t\t params-\u003ewait, \u0026cookie, skb,\n \t\t\t\t IEEE80211_ROC_TYPE_MGMT_TX);\n \tif (ret)\n \t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\ndiff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c\nindex ffd575a8d188f..dc2f662fe4c46 100644\n--- a/net/mac80211/tdls.c\n+++ b/net/mac80211/tdls.c\n@@ -1121,7 +1121,7 @@ ieee80211_tdls_prep_mgmt_packet(struct wiphy wiphy, struct net_device dev,\n \t/ disable bottom halves when entering the Tx path /\n \tlocal_bh_disable();\n \t__ieee80211_subif_start_xmit(skb, dev, flags,\n-\t\t\t\t IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, NULL);\n+\t\t\t\t IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, 0);\n \tlocal_bh_enable();\n \n \treturn ret;\ndiff --git a/net/mac80211/tx.c b/net/mac80211/tx.c\nindex 0cf5f6ec75e67..454a872b259a3 100644\n--- a/net/mac80211/tx.c\n+++ b/net/mac80211/tx.c\n@@ -2583,7 +2583,7 @@ int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data sdata,\n static u16 ieee80211_store_ack_skb(struct ieee80211_local local,\n \t\t\t\t struct sk_buff skb,\n \t\t\t\t u32 info_flags,\n-\t\t\t\t u64 cookie)\n+\t\t\t\t u64 cookie)\n {\n \tstruct sk_buff ack_skb;\n \tu16 info_id = 0;\n@@ -2605,10 +2605,8 @@ static u16 ieee80211_store_ack_skb(struct ieee80211_local local,\n \t\tif (id \u003e= 0) {\n \t\t\tinfo_id = id;\n \t\t\tinfo_flags \|= IEEE80211_TX_CTL_REQ_TX_STATUS;\n-\t\t\tif (cookie) {\n-\t\t\t\tcookie = ieee80211_mgmt_tx_cookie(local);\n-\t\t\t\tIEEE80211_SKB_CB(ack_skb)-\u003eack.cookie = cookie;\n-\t\t\t}\n+\t\t\tif (cookie)\n+\t\t\t\tIEEE80211_SKB_CB(ack_skb)-\u003eack.cookie = cookie;\n \t\t} else {\n \t\t\tkfree_skb(ack_skb);\n \t\t}\n@@ -2653,7 +2651,7 @@ static void ieee80211_remove_ack_skb(struct ieee80211_local local, u16 info_id)\n static struct sk_buff ieee80211_build_hdr(struct ieee80211_sub_if_data sdata,\n \t\t\t\t\t struct sk_buff skb, u32 info_flags,\n \t\t\t\t\t struct sta_info sta, u32 ctrl_flags,\n-\t\t\t\t\t u64 cookie)\n+\t\t\t\t\t u64 cookie)\n {\n \tstruct ieee80211_local local = sdata-\u003elocal;\n \tstruct ieee80211_tx_info info;\n@@ -4374,7 +4372,7 @@ void __ieee80211_subif_start_xmit(struct sk_buff skb,\n \t\t\t\t struct net_device dev,\n \t\t\t\t u32 info_flags,\n \t\t\t\t u32 ctrl_flags,\n-\t\t\t\t u64 cookie)\n+\t\t\t\t u64 cookie)\n {\n \tstruct ieee80211_sub_if_data sdata = IEEE80211_DEV_TO_SUB_IF(dev);\n \tstruct ieee80211_local local = sdata-\u003elocal;\n@@ -4569,7 +4567,7 @@ static void ieee80211_mlo_multicast_tx_one(struct ieee80211_sub_if_data sdata,\n \t\treturn;\n \n \tctrl_flags \|= u32_encode_bits(link_id, IEEE80211_TX_CTRL_MLO_LINK);\n-\t__ieee80211_subif_start_xmit(out, sdata-\u003edev, 0, ctrl_flags, NULL);\n+\t__ieee80211_subif_start_xmit(out, sdata-\u003edev, 0, ctrl_flags, 0);\n }\n \n static void ieee80211_mlo_multicast_tx(struct net_device dev,\n@@ -4584,8 +4582,7 @@ static void ieee80211_mlo_multicast_tx(struct net_device dev,\n \t\tctrl_flags \|= u32_encode_bits(__ffs(links),\n \t\t\t\t\t IEEE80211_TX_CTRL_MLO_LINK);\n \n-\t\t__ieee80211_subif_start_xmit(skb, sdata-\u003edev, 0, ctrl_flags,\n-\t\t\t\t\t NULL);\n+\t\t__ieee80211_subif_start_xmit(skb, sdata-\u003edev, 0, ctrl_flags, 0);\n \t\treturn;\n \t}\n \n@@ -4627,7 +4624,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff skb,\n \t\twhile ((skb = __skb_dequeue(\u0026queue)))\n \t\t\t__ieee80211_subif_start_xmit(skb, dev, 0,\n \t\t\t\t\t\t IEEE80211_TX_CTRL_MLO_LINK_UNSPEC,\n-\t\t\t\t\t\t NULL);\n+\t\t\t\t\t\t 0);\n \t} else if (ieee80211_vif_is_mld(\u0026sdata-\u003evif) \u0026\u0026\n \t\t ((sdata-\u003evif.type == NL80211_IFTYPE_AP \u0026\u0026\n \t\t !ieee80211_hw_check(\u0026sdata-\u003elocal-\u003ehw, MLO_MCAST_MULTI_LINK_TX)) \|\|\n@@ -4638,7 +4635,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff skb,\n normal:\n \t\t__ieee80211_subif_start_xmit(skb, dev, 0,\n \t\t\t\t\t IEEE80211_TX_CTRL_MLO_LINK_UNSPEC,\n-\t\t\t\t\t NULL);\n+\t\t\t\t\t 0);\n \t}\n \n \treturn NETDEV_TX_OK;\n@@ -4737,7 +4734,7 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data sdata,\n \t\t\t/* fall back to non-offload slow path /\n \t\t\t__ieee80211_subif_start_xmit(skb, dev, 0,\n \t\t\t\t\t\t IEEE80211_TX_CTRL_MLO_LINK_UNSPEC,\n-\t\t\t\t\t\t NULL);\n+\t\t\t\t\t\t 0);\n \t\t\treturn;\n \t\t}\n \n@@ -4773,7 +4770,7 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data sdata,\n \n \tif (unlikely(sk_requests_wifi_status(skb-\u003esk))) {\n \t\tinfo-\u003estatus_data = ieee80211_store_ack_skb(local, skb,\n-\t\t\t\t\t\t\t \u0026info-\u003eflags, NULL);\n+\t\t\t\t\t\t\t \u0026info-\u003eflags, 0);\n \t\tif (info-\u003estatus_data)\n \t\t\tinfo-\u003estatus_data_idr = 1;\n \t}\n@@ -4916,7 +4913,7 @@ ieee80211_build_data_template(struct ieee80211_sub_if_data sdata,\n \t}\n \n \tskb = ieee80211_build_hdr(sdata, skb, info_flags, sta,\n-\t\t\t\t IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, NULL);\n+\t\t\t\t IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, 0);\n \tif (IS_ERR(skb))\n \t\tgoto out;\n \n@@ -6531,7 +6528,7 @@ void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data sdata,\n int ieee80211_tx_control_port(struct wiphy wiphy, struct net_device dev,\n \t\t\t const u8 buf, size_t len,\n \t\t\t const u8 dest, __be16 proto, bool unencrypted,\n-\t\t\t int link_id, u64 cookie)\n+\t\t\t int link_id, u64 cookie)\n {\n \tstruct ieee80211_sub_if_data sdata = IEEE80211_DEV_TO_SUB_IF(dev);\n \tstruct ieee80211_local local = sdata-\u003elocal;\n@@ -6666,7 +6663,7 @@ int ieee80211_probe_mesh_link(struct wiphy wiphy, struct net_device dev,\n \tlocal_bh_disable();\n \t__ieee80211_subif_start_xmit(skb, skb-\u003edev, 0,\n \t\t\t\t IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP,\n-\t\t\t\t NULL);\n+\t\t\t\t 0);\n \tlocal_bh_enable();\n \n \treturn 0;\ndiff --git a/net/wireless/core.h b/net/wireless/core.h\nindex 15d9f7eb58b4d..b4610f6685dcb 100644\n--- a/net/wireless/core.h\n+++ b/net/wireless/core.h\n@@ -402,7 +402,7 @@ void cfg80211_mlme_purge_registrations(struct wireless_dev wdev);\n int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device rdev,\n \t\t\t struct wireless_dev wdev,\n \t\t\t struct cfg80211_mgmt_tx_params params,\n-\t\t\t u64 cookie);\n+\t\t\t u64 cookie);\n void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap ht_capa,\n \t\t\t const struct ieee80211_ht_cap ht_capa_mask);\n void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap vht_capa,\ndiff --git a/net/wireless/mlme.c b/net/wireless/mlme.c\nindex 7824b7ac2770f..a0d1cde26f0c9 100644\n--- a/net/wireless/mlme.c\n+++ b/net/wireless/mlme.c\n@@ -894,7 +894,7 @@ static bool cfg80211_allowed_random_address(struct wireless_dev wdev,\n \n int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device rdev,\n \t\t\t struct wireless_dev wdev,\n-\t\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n+\t\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n {\n \tconst struct ieee80211_mgmt mgmt;\n \tu16 stype;\ndiff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c\nindex 8adbef5f04425..ac895e02cd411 100644\n--- a/net/wireless/nl80211.c\n+++ b/net/wireless/nl80211.c\n@@ -14642,8 +14642,9 @@ static int nl80211_remain_on_channel(struct sk_buff skb,\n \t\tgoto free_msg;\n \t}\n \n+\tcookie = cfg80211_assign_cookie(rdev);\n \terr = rdev_remain_on_channel(rdev, wdev, chandef.chan,\n-\t\t\t\t duration, \u0026cookie, rx_addr);\n+\t\t\t\t duration, cookie, rx_addr);\n \n \tif (err)\n \t\tgoto free_msg;\n@@ -14883,7 +14884,8 @@ static int nl80211_tx_mgmt(struct sk_buff skb, struct genl_info info)\n \t}\n \n \tparams.chan = chandef.chan;\n-\terr = cfg80211_mlme_mgmt_tx(rdev, wdev, \u0026params, \u0026cookie);\n+\tcookie = cfg80211_assign_cookie(rdev);\n+\terr = cfg80211_mlme_mgmt_tx(rdev, wdev, \u0026params, cookie);\n \tif (err)\n \t\tgoto free_msg;\n \n@@ -16371,7 +16373,8 @@ static int nl80211_probe_peer(struct sk_buff skb, struct genl_info info)\n \t\tgoto free_msg;\n \t}\n \n-\terr = rdev_probe_peer(rdev, dev, addr, \u0026cookie);\n+\tcookie = cfg80211_assign_cookie(rdev);\n+\terr = rdev_probe_peer(rdev, dev, addr, cookie);\n \tif (err)\n \t\tgoto free_msg;\n \n@@ -18586,10 +18589,11 @@ static int nl80211_tx_control_port(struct sk_buff skb, struct genl_info info)\n \n \tlink_id = nl80211_link_id_or_invalid(info-\u003eattrs);\n \n+\tcookie = dont_wait_for_ack ? 0 : cfg80211_assign_cookie(rdev);\n \terr = rdev_tx_control_port(rdev, dev, buf, len,\n \t\t\t\t dest, cpu_to_be16(proto), noencrypt, link_id,\n-\t\t\t\t dont_wait_for_ack ? NULL : \u0026cookie);\n-\tif (!err \u0026\u0026 !dont_wait_for_ack)\n+\t\t\t\t cookie);\n+\tif (!err \u0026\u0026 cookie)\n \t\tnl_set_extack_cookie_u64(info-\u003eextack, cookie);\n \treturn err;\n }\n@@ -22042,6 +22046,10 @@ static void nl80211_frame_tx_status(struct wireless_dev wdev,\n \tstruct sk_buff msg;\n \tvoid hdr;\n \n+\t/* userspace not interested in zero-cookie status /\n+\tif (!status-\u003ecookie)\n+\t\treturn;\n+\n \tif (command == NL80211_CMD_FRAME_TX_STATUS)\n \t\ttrace_cfg80211_mgmt_tx_status(wdev, status-\u003ecookie,\n \t\t\t\t\t status-\u003eack);\ndiff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h\nindex 6c3bad8b2d6f6..46849fe8d0b39 100644\n--- a/net/wireless/rdev-ops.h\n+++ b/net/wireless/rdev-ops.h\n@@ -736,14 +736,14 @@ static inline int\n rdev_remain_on_channel(struct cfg80211_registered_device rdev,\n \t\t struct wireless_dev wdev,\n \t\t struct ieee80211_channel chan,\n-\t\t unsigned int duration, u64 cookie, const u8 rx_addr)\n+\t\t unsigned int duration, u64 cookie, const u8 rx_addr)\n {\n \tint ret;\n \ttrace_rdev_remain_on_channel(\u0026rdev-\u003ewiphy, wdev, chan, duration,\n \t\t\t\t rx_addr);\n \tret = rdev-\u003eops-\u003eremain_on_channel(\u0026rdev-\u003ewiphy, wdev, chan,\n \t\t\t\t\t duration, cookie, rx_addr);\n-\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, cookie);\n+\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, cookie);\n \treturn ret;\n }\n \n@@ -761,12 +761,12 @@ rdev_cancel_remain_on_channel(struct cfg80211_registered_device rdev,\n static inline int rdev_mgmt_tx(struct cfg80211_registered_device rdev,\n \t\t\t struct wireless_dev wdev,\n \t\t\t struct cfg80211_mgmt_tx_params params,\n-\t\t\t u64 cookie)\n+\t\t\t u64 cookie)\n {\n \tint ret;\n \ttrace_rdev_mgmt_tx(\u0026rdev-\u003ewiphy, wdev, params);\n \tret = rdev-\u003eops-\u003emgmt_tx(\u0026rdev-\u003ewiphy, wdev, params, cookie);\n-\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, cookie);\n+\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, cookie);\n \treturn ret;\n }\n \n@@ -775,7 +775,7 @@ static inline int rdev_tx_control_port(struct cfg80211_registered_device rdev,\n \t\t\t\t const void buf, size_t len,\n \t\t\t\t const u8 dest, __be16 proto,\n \t\t\t\t const bool noencrypt, int link,\n-\t\t\t\t u64 cookie)\n+\t\t\t\t u64 cookie)\n {\n \tint ret;\n \ttrace_rdev_tx_control_port(\u0026rdev-\u003ewiphy, dev, buf, len,\n@@ -783,7 +783,7 @@ static inline int rdev_tx_control_port(struct cfg80211_registered_device rdev,\n \tret = rdev-\u003eops-\u003etx_control_port(\u0026rdev-\u003ewiphy, dev, buf, len,\n \t\t\t\t\t dest, proto, noencrypt, link, cookie);\n \tif (cookie)\n-\t\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, cookie);\n+\t\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, cookie);\n \telse\n \t\ttrace_rdev_return_int(\u0026rdev-\u003ewiphy, ret);\n \treturn ret;\n@@ -950,12 +950,12 @@ static inline int rdev_tdls_oper(struct cfg80211_registered_device rdev,\n \n static inline int rdev_probe_peer(struct cfg80211_registered_device rdev,\n \t\t\t\t struct net_device dev, const u8 peer,\n-\t\t\t\t u64 cookie)\n+\t\t\t\t u64 cookie)\n {\n \tint ret;\n \ttrace_rdev_probe_peer(\u0026rdev-\u003ewiphy, dev, peer);\n \tret = rdev-\u003eops-\u003eprobe_peer(\u0026rdev-\u003ewiphy, dev, peer, cookie);\n-\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, cookie);\n+\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, cookie);\n \treturn ret;\n }\n \n" }
2/1	2026/08/01 19:22	agent	patch-evaluator	1m Model: best-expensive Args: null Results: { "EnableConfigs": [ "CFG80211", "MAC80211", "MAC80211_HWSIM" ], "FocusSymbols": [ "nl80211_remain_on_channel", "nl80211_tx_mgmt", "nl80211_probe_peer", "nl80211_tx_control_port", "cfg80211_mlme_mgmt_tx", "ieee80211_remain_on_channel", "ieee80211_mgmt_tx", "ieee80211_probe_peer", "ieee80211_tx_control_port", "ieee80211_attach_ack_skb", "ieee80211_start_roc_work" ], "Reasoning": "The patch changes how cookies are generated and passed for several nl80211 commands (remain_on_channel, tx_mgmt, probe_peer, tx_control_port). It modifies the core cfg80211 and mac80211 logic to generate cookies in nl80211 and pass them by value to drivers, instead of having drivers generate them and pass them back via pointers. This is a functional change to the core wireless stack and should be fuzzed.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit db647f403d99a4369043df3c05eea5ddf840805d Author: syz-cluster <triage@syzkaller.com> Date: Sat Aug 1 19:22:36 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c index ecde91159b546..34025d64d6158 100644 --- a/drivers/net/wireless/ath/ath6kl/cfg80211.c +++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c @@ -3034,20 +3034,14 @@ static int ath6kl_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev, struct ieee80211_channel chan, unsigned int duration, - u64 cookie, const u8 rx_addr) + u64 cookie, const u8 rx_addr) { struct ath6kl_vif vif = ath6kl_vif_from_wdev(wdev); struct ath6kl ar = ath6kl_priv(vif->ndev); - u32 id; /* TODO: if already pending or ongoing remain-on-channel, * return -EBUSY / - id = ++vif->last_roc_id; - if (id == 0) { - / Do not use 0 as the cookie value / - id = ++vif->last_roc_id; - } - cookie = id; + vif->last_roc_id = cookie; return ath6kl_wmi_remain_on_chnl_cmd(ar->wmi, vif->fw_vif_idx, chan->center_freq, duration); @@ -3106,6 +3100,7 @@ static int ath6kl_send_go_probe_resp(struct ath6kl_vif vif, static bool ath6kl_mgmt_powersave_ap(struct ath6kl_vif vif, u32 id, + u64 cookie, u32 freq, u32 wait, const u8 buf, @@ -3138,6 +3133,7 @@ static bool ath6kl_mgmt_powersave_ap(struct ath6kl_vif vif, INIT_LIST_HEAD(&mgmt_buf->list); mgmt_buf->id = id; + mgmt_buf->cookie = cookie; mgmt_buf->freq = freq; mgmt_buf->wait = wait; mgmt_buf->len = len; @@ -3190,7 +3186,7 @@ static bool ath6kl_is_p2p_go_ssid(const u8 buf, size_t len) } static int ath6kl_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, - struct cfg80211_mgmt_tx_params params, u64 cookie) + struct cfg80211_mgmt_tx_params params, u64 cookie) { struct ath6kl_vif vif = ath6kl_vif_from_wdev(wdev); struct ath6kl ar = ath6kl_priv(vif->ndev); @@ -3222,7 +3218,6 @@ static int ath6kl_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, * Send Probe Response frame in GO mode using a separate WMI * command to allow the target to fill in the generic IEs. / - cookie = 0; /* TX status not supported / return ath6kl_send_go_probe_resp(vif, buf, len, freq); } @@ -3235,16 +3230,15 @@ static int ath6kl_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, id = vif->send_action_id++; } - cookie = id; - /* AP mode Power saving processing / if (vif->nw_type == AP_NETWORK) { - queued = ath6kl_mgmt_powersave_ap(vif, id, freq, wait, buf, len, - &more_data, no_cck); + queued = ath6kl_mgmt_powersave_ap(vif, id, cookie, freq, wait, + buf, len, &more_data, no_cck); if (queued) return 0; } + ar->wmi->last_mgmt_tx_cookie = cookie; return ath6kl_wmi_send_mgmt_cmd(ar->wmi, vif->fw_vif_idx, id, freq, wait, buf, len, no_cck); } diff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h index 77e052336eb5b..a0b236eeeab54 100644 --- a/drivers/net/wireless/ath/ath6kl/core.h +++ b/drivers/net/wireless/ath/ath6kl/core.h @@ -404,6 +404,7 @@ struct ath6kl_mgmt_buff { u32 freq; u32 wait; u32 id; + u64 cookie; bool no_cck; size_t len; u8 buf[]; @@ -631,8 +632,8 @@ struct ath6kl_vif { struct cfg80211_scan_request scan_req; enum sme_state sme_state; int reconnect_flag; - u32 last_roc_id; - u32 last_cancel_roc_id; + u64 last_roc_id; + u64 last_cancel_roc_id; u32 send_action_id; bool probe_req_report; u16 assoc_bss_beacon_int; diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c index 8afc6589fc51e..9c023d7ce3059 100644 --- a/drivers/net/wireless/ath/ath6kl/main.c +++ b/drivers/net/wireless/ath/ath6kl/main.c @@ -898,6 +898,7 @@ void ath6kl_pspoll_event(struct ath6kl_vif vif, u8 aid) spin_unlock_bh(&conn->psq_lock); conn->sta_flags \|= STA_PS_POLLED; + ar->wmi->last_mgmt_tx_cookie = mgmt_buf->cookie; ath6kl_wmi_send_mgmt_cmd(ar->wmi, vif->fw_vif_idx, mgmt_buf->id, mgmt_buf->freq, mgmt_buf->wait, mgmt_buf->buf, diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c index d818254139061..609d458ca6c57 100644 --- a/drivers/net/wireless/ath/ath6kl/txrx.c +++ b/drivers/net/wireless/ath/ath6kl/txrx.c @@ -1469,6 +1469,7 @@ void ath6kl_rx(struct htc_target target, struct htc_packet packet) spin_unlock_bh(&conn->psq_lock); idx = vif->fw_vif_idx; + ar->wmi->last_mgmt_tx_cookie = mgmt->cookie; ath6kl_wmi_send_mgmt_cmd(ar->wmi, idx, mgmt->id, diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c index 6c29f0bcec9f5..2140fddba8baf 100644 --- a/drivers/net/wireless/ath/ath6kl/wmi.c +++ b/drivers/net/wireless/ath/ath6kl/wmi.c @@ -596,7 +596,7 @@ static int ath6kl_wmi_tx_status_event_rx(struct wmi wmi, u8 datap, int len, ath6kl_dbg(ATH6KL_DBG_WMI, "tx_status: id=%x ack_status=%u\n", id, ev->ack_status); if (wmi->last_mgmt_tx_frame) { - cfg80211_mgmt_tx_status(&vif->wdev, id, + cfg80211_mgmt_tx_status(&vif->wdev, wmi->last_mgmt_tx_cookie, wmi->last_mgmt_tx_frame, wmi->last_mgmt_tx_frame_len, !!ev->ack_status, GFP_ATOMIC); diff --git a/drivers/net/wireless/ath/ath6kl/wmi.h b/drivers/net/wireless/ath/ath6kl/wmi.h index 8fbece3fdad9f..89ce2abbb1cdc 100644 --- a/drivers/net/wireless/ath/ath6kl/wmi.h +++ b/drivers/net/wireless/ath/ath6kl/wmi.h @@ -125,6 +125,7 @@ struct wmi { u8 last_mgmt_tx_frame; size_t last_mgmt_tx_frame_len; + u64 last_mgmt_tx_cookie; u8 saved_pwr_mode; }; diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c index 5f2bd9a31faf6..9ac33d827f801 100644 --- a/drivers/net/wireless/ath/wil6210/cfg80211.c +++ b/drivers/net/wireless/ath/wil6210/cfg80211.c @@ -1432,7 +1432,7 @@ static int wil_cfg80211_set_wiphy_params(struct wiphy wiphy, int radio_idx, int wil_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, struct cfg80211_mgmt_tx_params params, - u64 cookie) + u64 cookie) { const u8 buf = params->buf; size_t len = params->len; @@ -1488,8 +1488,7 @@ int wil_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, / tx_status = (rc == 0); rc = (rc == -EAGAIN) ? 0 : rc; - cfg80211_mgmt_tx_status(wdev, cookie ? cookie : 0, buf, len, - tx_status, GFP_KERNEL); + cfg80211_mgmt_tx_status(wdev, cookie, buf, len, tx_status, GFP_KERNEL); return rc; } @@ -1735,7 +1734,7 @@ static int wil_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev, struct ieee80211_channel chan, unsigned int duration, - u64 cookie, const u8 rx_addr) + u64 cookie, const u8 rx_addr) { struct wil6210_priv wil = wiphy_to_wil(wiphy); int rc; @@ -2381,7 +2380,7 @@ void wil_probe_client_flush(struct wil6210_vif vif) static int wil_cfg80211_probe_peer(struct wiphy wiphy, struct net_device dev, - const u8 peer, u64 cookie) + const u8 peer, u64 cookie) { struct wil6210_priv wil = wiphy_to_wil(wiphy); struct wil6210_vif vif = ndev_to_vif(dev); @@ -2399,13 +2398,12 @@ static int wil_cfg80211_probe_peer(struct wiphy wiphy, return -ENOMEM; req->cid = cid; - req->cookie = cid; + req->cookie = cookie; mutex_lock(&vif->probe_client_mutex); list_add_tail(&req->list, &vif->probe_client_pending); mutex_unlock(&vif->probe_client_mutex); - cookie = req->cookie; queue_work(wil->wq_service, &vif->probe_client_worker); return 0; } diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c index b8cb736a71852..e06e45323272c 100644 --- a/drivers/net/wireless/ath/wil6210/debugfs.c +++ b/drivers/net/wireless/ath/wil6210/debugfs.c @@ -985,7 +985,7 @@ static ssize_t wil_write_file_txmgmt(struct file file, const char __user buf, params.buf = frame; params.len = len; - rc = wil_cfg80211_mgmt_tx(wiphy, wdev, &params, NULL); + rc = wil_cfg80211_mgmt_tx(wiphy, wdev, &params, 0); kfree(frame); wil_info(wil, "-> %d\n", rc); diff --git a/drivers/net/wireless/ath/wil6210/p2p.c b/drivers/net/wireless/ath/wil6210/p2p.c index f20caf1a3905b..acd8a2e351032 100644 --- a/drivers/net/wireless/ath/wil6210/p2p.c +++ b/drivers/net/wireless/ath/wil6210/p2p.c @@ -124,7 +124,7 @@ int wil_p2p_search(struct wil6210_vif vif, int wil_p2p_listen(struct wil6210_priv wil, struct wireless_dev wdev, unsigned int duration, struct ieee80211_channel chan, - u64 cookie) + u64 cookie) { struct wil6210_vif vif = wdev_to_vif(wil, wdev); struct wil_p2p_info p2p = &vif->p2p; @@ -144,7 +144,7 @@ int wil_p2p_listen(struct wil6210_priv wil, struct wireless_dev wdev, } memcpy(&p2p->listen_chan, chan, sizeof(chan)); - cookie = ++p2p->cookie; + p2p->cookie = cookie; p2p->listen_duration = duration; mutex_lock(&wil->vif_mutex); @@ -166,7 +166,7 @@ int wil_p2p_listen(struct wil6210_priv wil, struct wireless_dev wdev, if (vif->mid == 0) wil->radio_wdev = wdev; - cfg80211_ready_on_channel(wdev, cookie, chan, duration, + cfg80211_ready_on_channel(wdev, cookie, chan, duration, GFP_KERNEL); out: diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h index 31e107c81e2d4..f8e60be631ca5 100644 --- a/drivers/net/wireless/ath/wil6210/wil6210.h +++ b/drivers/net/wireless/ath/wil6210/wil6210.h @@ -1301,7 +1301,7 @@ int wil_p2p_search(struct wil6210_vif vif, struct cfg80211_scan_request request); int wil_p2p_listen(struct wil6210_priv wil, struct wireless_dev wdev, unsigned int duration, struct ieee80211_channel chan, - u64 cookie); + u64 cookie); u8 wil_p2p_stop_discovery(struct wil6210_vif vif); int wil_p2p_cancel_listen(struct wil6210_vif vif, u64 cookie); void wil_p2p_listen_expired(struct work_struct work); @@ -1317,7 +1317,7 @@ int wmi_stop_discovery(struct wil6210_vif vif); int wil_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, struct cfg80211_mgmt_tx_params params, - u64 cookie); + u64 cookie); void wil_cfg80211_ap_recovery(struct wil6210_priv wil); int wil_cfg80211_iface_combinations_from_fw( struct wil6210_priv wil, diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index 6b2c34e3a796c..872c48806d091 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -5554,7 +5554,7 @@ brcmf_cfg80211_update_mgmt_frame_registrations(struct wiphy wiphy, int brcmf_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, - struct cfg80211_mgmt_tx_params params, u64 cookie) + struct cfg80211_mgmt_tx_params params, u64 cookie) { struct brcmf_cfg80211_info cfg = wiphy_to_cfg(wiphy); struct ieee80211_channel chan = params->chan; @@ -5573,8 +5573,6 @@ brcmf_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, brcmf_dbg(TRACE, "Enter\n"); - cookie = 0; - mgmt = (const struct ieee80211_mgmt )buf; if (!ieee80211_is_mgmt(mgmt->frame_control)) { @@ -5605,7 +5603,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, BRCMF_VNDR_IE_PRBRSP_FLAG, &buf[ie_offset], ie_len); - cfg80211_mgmt_tx_status(wdev, cookie, buf, len, true, + cfg80211_mgmt_tx_status(wdev, cookie, buf, len, true, GFP_KERNEL); } else if (ieee80211_is_action(mgmt->frame_control)) { if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) { @@ -5621,7 +5619,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, } action_frame = &af_params->action_frame; /* Add the packet Id / - action_frame->packet_id = cpu_to_le32(cookie); + action_frame->packet_id = cpu_to_le32(cookie); /* Add BSSID / memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN); memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN); @@ -5649,12 +5647,12 @@ brcmf_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, le16_to_cpu(action_frame->len)); brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, channel=%d\n", - cookie, le16_to_cpu(action_frame->len), + cookie, le16_to_cpu(action_frame->len), le32_to_cpu(af_params->channel)); ack = brcmf_p2p_send_action_frame(vif->ifp, af_params); - cfg80211_mgmt_tx_status(wdev, cookie, buf, len, ack, + cfg80211_mgmt_tx_status(wdev, cookie, buf, len, ack, GFP_KERNEL); free: kfree(af_params); diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h index 6ceb301429054..63e534523f518 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h @@ -497,6 +497,6 @@ void brcmf_cfg80211_free_vif(struct net_device ndev); int brcmf_set_wsec(struct brcmf_if ifp, const u8 key, u16 key_len, u16 flags); int brcmf_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, - struct cfg80211_mgmt_tx_params params, u64 cookie); + struct cfg80211_mgmt_tx_params params, u64 cookie); #endif / BRCMFMAC_CFG80211_H / diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c index 873754be5174b..545eb9aae9660 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c @@ -100,7 +100,7 @@ static int brcmf_cyw_activate_events(struct brcmf_if ifp) static int brcmf_cyw_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, - struct cfg80211_mgmt_tx_params params, u64 cookie) + struct cfg80211_mgmt_tx_params params, u64 cookie) { struct brcmf_cfg80211_info cfg = wiphy_to_cfg(wiphy); struct ieee80211_channel chan = params->chan; @@ -123,7 +123,6 @@ int brcmf_cyw_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, if (!ieee80211_is_auth(mgmt->frame_control)) return brcmf_cfg80211_mgmt_tx(wiphy, wdev, params, cookie); - cookie = 0; vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev); reinit_completion(&vif->mgmt_tx); @@ -155,7 +154,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, memcpy(&mf_params->da[0], &mgmt->da[0], ETH_ALEN); memcpy(&mf_params->bssid[0], &mgmt->bssid[0], ETH_ALEN); - mf_params->packet_id = cpu_to_le32(cookie); + mf_params->packet_id = cpu_to_le32(cookie); memcpy(mf_params->data, &buf[DOT11_MGMT_HDR_LEN], le16_to_cpu(mf_params->len)); @@ -187,8 +186,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, } tx_status: - cfg80211_mgmt_tx_status(wdev, cookie, buf, len, ack, - GFP_KERNEL); + cfg80211_mgmt_tx_status(wdev, cookie, buf, len, ack, GFP_KERNEL); free: kfree(mf_params); return err; diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c index c7d7b35ab1253..32a015d6b7698 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c @@ -979,10 +979,8 @@ brcmf_p2p_discover_listen(struct brcmf_p2p_info p2p, u16 channel, u32 duration) p2p->cfg->d11inf.encchspec(&ch); err = brcmf_p2p_set_discover_state(vif->ifp, WL_P2P_DISC_ST_LISTEN, ch.chspec, (u16)duration); - if (!err) { + if (!err) set_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status); - p2p->remain_on_channel_cookie++; - } exit: return err; } @@ -1000,7 +998,7 @@ brcmf_p2p_discover_listen(struct brcmf_p2p_info p2p, u16 channel, u32 duration) / int brcmf_p2p_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev, struct ieee80211_channel channel, - unsigned int duration, u64 cookie, + unsigned int duration, u64 cookie, const u8 rx_addr) { struct brcmf_cfg80211_info cfg = wiphy_to_cfg(wiphy); @@ -1020,8 +1018,8 @@ int brcmf_p2p_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev, goto exit; memcpy(&p2p->remain_on_channel, channel, sizeof(channel)); - cookie = p2p->remain_on_channel_cookie; - cfg80211_ready_on_channel(wdev, cookie, channel, duration, GFP_KERNEL); + p2p->remain_on_channel_cookie = cookie; + cfg80211_ready_on_channel(wdev, cookie, channel, duration, GFP_KERNEL); exit: return err; diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h index 9f3f01ade2b77..7078009491707 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h @@ -157,7 +157,7 @@ int brcmf_p2p_scan_prep(struct wiphy wiphy, struct brcmf_cfg80211_vif vif); int brcmf_p2p_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev, struct ieee80211_channel channel, - unsigned int duration, u64 cookie, + unsigned int duration, u64 cookie, const u8 rx_addr); int brcmf_p2p_notify_listen_complete(struct brcmf_if ifp, const struct brcmf_event_msg e, diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c index 8ec2d22a8c33a..7a1ba32f1fb36 100644 --- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c +++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c @@ -196,7 +196,7 @@ mwifiex_form_mgmt_frame(struct sk_buff skb, const u8 buf, size_t len) / static int mwifiex_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, - struct cfg80211_mgmt_tx_params params, u64 cookie) + struct cfg80211_mgmt_tx_params params, u64 cookie) { const u8 buf = params->buf; size_t len = params->len; @@ -259,14 +259,13 @@ mwifiex_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, tx_info->pkt_len = pkt_len; mwifiex_form_mgmt_frame(skb, buf, len); - cookie = get_random_u32() \| 1; if (ieee80211_is_action(mgmt->frame_control)) skb = mwifiex_clone_skb_for_tx_status(priv, skb, - MWIFIEX_BUF_FLAG_ACTION_TX_STATUS, cookie); + MWIFIEX_BUF_FLAG_ACTION_TX_STATUS, &cookie); else - cfg80211_mgmt_tx_status(wdev, cookie, buf, len, true, + cfg80211_mgmt_tx_status(wdev, cookie, buf, len, true, GFP_ATOMIC); mwifiex_queue_tx_pkt(priv, skb); @@ -304,13 +303,13 @@ static int mwifiex_cfg80211_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev, struct ieee80211_channel chan, - unsigned int duration, u64 cookie, + unsigned int duration, u64 cookie, const u8 rx_addr) { struct mwifiex_private priv = mwifiex_netdev_get_priv(wdev->netdev); int ret; - if (!chan \|\| !cookie) { + if (!chan) { mwifiex_dbg(priv->adapter, ERROR, "Invalid parameter for ROC\n"); return -EINVAL; } @@ -326,15 +325,14 @@ mwifiex_cfg80211_remain_on_channel(struct wiphy wiphy, duration); if (!ret) { - cookie = get_random_u32() \| 1; - priv->roc_cfg.cookie = cookie; + priv->roc_cfg.cookie = cookie; priv->roc_cfg.chan = chan; - cfg80211_ready_on_channel(wdev, cookie, chan, + cfg80211_ready_on_channel(wdev, cookie, chan, duration, GFP_ATOMIC); mwifiex_dbg(priv->adapter, INFO, - "info: ROC, cookie = 0x%llx\n", cookie); + "info: ROC, cookie = 0x%llx\n", cookie); } return ret; @@ -4560,7 +4558,7 @@ mwifiex_cfg80211_disassociate(struct wiphy wiphy, static int mwifiex_cfg80211_probe_peer(struct wiphy wiphy, struct net_device dev, const u8 peer, - u64 cookie) + u64 cookie) { / hostapd looks for NL80211_CMD_PROBE_CLIENT support; otherwise, * it requires monitor-mode support (which mwifiex doesn't support). diff --git a/drivers/net/wireless/microchip/wilc1000/cfg80211.c b/drivers/net/wireless/microchip/wilc1000/cfg80211.c index 6654fce4ded84..bb2748a193294 100644 --- a/drivers/net/wireless/microchip/wilc1000/cfg80211.c +++ b/drivers/net/wireless/microchip/wilc1000/cfg80211.c @@ -1100,24 +1100,19 @@ static void wilc_wfi_remain_on_channel_expired(struct wilc_vif vif, u64 cookie) static int remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev, struct ieee80211_channel chan, - unsigned int duration, u64 cookie, + unsigned int duration, u64 cookie, const u8 rx_addr) { int ret = 0; struct wilc_vif vif = netdev_priv(wdev->netdev); struct wilc_priv priv = &vif->priv; - u64 id; if (wdev->iftype == NL80211_IFTYPE_AP) { netdev_dbg(vif->ndev, "Required while in AP mode\n"); return ret; } - id = ++priv->inc_roc_cookie; - if (id == 0) - id = ++priv->inc_roc_cookie; - - ret = wilc_remain_on_channel(vif, id, chan->hw_value, + ret = wilc_remain_on_channel(vif, cookie, chan->hw_value, wilc_wfi_remain_on_channel_expired); if (ret) return ret; @@ -1125,12 +1120,11 @@ static int remain_on_channel(struct wiphy wiphy, vif->wilc->op_ch = chan->hw_value; priv->remain_on_ch_params.listen_ch = chan; - priv->remain_on_ch_params.listen_cookie = id; - cookie = id; + priv->remain_on_ch_params.listen_cookie = cookie; priv->p2p_listen_state = true; priv->remain_on_ch_params.listen_duration = duration; - cfg80211_ready_on_channel(wdev, cookie, chan, duration, GFP_KERNEL); + cfg80211_ready_on_channel(wdev, cookie, chan, duration, GFP_KERNEL); mod_timer(&vif->hif_drv->remain_on_ch_timer, jiffies + msecs_to_jiffies(duration + 1000)); @@ -1153,7 +1147,7 @@ static int cancel_remain_on_channel(struct wiphy wiphy, static int mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, struct cfg80211_mgmt_tx_params params, - u64 cookie) + u64 cookie) { struct ieee80211_channel chan = params->chan; unsigned int wait = params->wait; @@ -1170,8 +1164,7 @@ static int mgmt_tx(struct wiphy wiphy, const u8 vendor_ie; int ret = 0; - cookie = get_random_u32(); - priv->tx_cookie = cookie; + priv->tx_cookie = cookie; mgmt = (const struct ieee80211_mgmt )buf; if (!ieee80211_is_mgmt(mgmt->frame_control)) diff --git a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c index 4f9e20f728114..c820f08d28355 100644 --- a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c +++ b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c @@ -150,7 +150,7 @@ nxpwifi_form_mgmt_frame(struct sk_buff skb, const u8 buf, size_t len) /* cfg80211 operation handler to transmit a management frame. / static int nxpwifi_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, - struct cfg80211_mgmt_tx_params params, u64 cookie) + struct cfg80211_mgmt_tx_params params, u64 cookie) { const u8 buf = params->buf; size_t len = params->len; @@ -212,14 +212,13 @@ nxpwifi_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, tx_info->pkt_len = pkt_len; nxpwifi_form_mgmt_frame(skb, buf, len); - cookie = nxpwifi_roc_cookie(priv->adapter); if (ieee80211_is_action(mgmt->frame_control)) skb = nxpwifi_clone_skb_for_tx_status(priv, skb, - NXPWIFI_BUF_FLAG_ACTION_TX_STATUS, cookie); + NXPWIFI_BUF_FLAG_ACTION_TX_STATUS, &cookie); else - cfg80211_mgmt_tx_status(wdev, cookie, buf, len, true, + cfg80211_mgmt_tx_status(wdev, cookie, buf, len, true, GFP_ATOMIC); nxpwifi_queue_tx_pkt(priv, skb); @@ -254,14 +253,14 @@ static int nxpwifi_cfg80211_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev, struct ieee80211_channel chan, - unsigned int duration, u64 cookie, + unsigned int duration, u64 cookie, const u8 rx_addr) { struct nxpwifi_private priv = nxpwifi_netdev_get_priv(wdev->netdev); struct nxpwifi_adapter adapter = priv->adapter; int ret; - if (!chan \|\| !cookie) { + if (!chan) { nxpwifi_dbg(adapter, ERROR, "Invalid parameter for ROC\n"); return -EINVAL; } @@ -277,15 +276,14 @@ nxpwifi_cfg80211_remain_on_channel(struct wiphy wiphy, duration); if (!ret) { - cookie = nxpwifi_roc_cookie(adapter); - priv->roc_cfg.cookie = cookie; + priv->roc_cfg.cookie = cookie; priv->roc_cfg.chan = chan; - cfg80211_ready_on_channel(wdev, cookie, chan, + cfg80211_ready_on_channel(wdev, cookie, chan, duration, GFP_ATOMIC); nxpwifi_dbg(adapter, INFO, - "info: ROC, cookie = 0x%llx\n", cookie); + "info: ROC, cookie = 0x%llx\n", cookie); } return ret; @@ -3618,7 +3616,7 @@ nxpwifi_cfg80211_disassociate(struct wiphy wiphy, static int nxpwifi_cfg80211_probe_peer(struct wiphy wiphy, struct net_device dev, const u8 peer, - u64 cookie) + u64 cookie) { / * hostapd looks for NL80211_CMD_PROBE_CLIENT support; otherwise, diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c index 9e44c85d2051c..45e2b7ae96333 100644 --- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c +++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c @@ -446,7 +446,7 @@ qtnf_update_mgmt_frame_registrations(struct wiphy wiphy, static int qtnf_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, - struct cfg80211_mgmt_tx_params params, u64 cookie) + struct cfg80211_mgmt_tx_params params, u64 cookie) { struct qtnf_vif vif = qtnf_netdev_get_priv(wdev->netdev); const struct ieee80211_mgmt mgmt_frame = (void )params->buf; @@ -454,8 +454,6 @@ qtnf_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, u16 flags = 0; u16 freq; - cookie = short_cookie; - if (params->offchan) flags \|= QLINK_FRAME_TX_FLAG_OFFCHAN; diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c index 6a97afd89dc78..b58dda129ff66 100644 --- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c +++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c @@ -2530,7 +2530,7 @@ static int _cfg80211_rtw_mgmt_tx(struct adapter padapter, u8 tx_ch, const u8 b static int cfg80211_rtw_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, struct cfg80211_mgmt_tx_params params, - u64 cookie) + u64 cookie) { struct net_device ndev = wdev_to_ndev(wdev); struct ieee80211_channel chan = params->chan; @@ -2552,11 +2552,8 @@ static int cfg80211_rtw_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, padapter = rtw_netdev_priv(ndev); - /* cookie generation / - cookie = (unsigned long)buf; - /* indicate ack before issue frame to avoid racing with rsp frame / - rtw_cfg80211_mgmt_tx_status(padapter, cookie, buf, len, ack, GFP_KERNEL); + rtw_cfg80211_mgmt_tx_status(padapter, cookie, buf, len, ack, GFP_KERNEL); if (!rtw_action_frame_parse(buf, len, &category, &action)) goto exit; diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index dcbb0e55c32ec..97c16d4ff1271 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -5108,7 +5108,8 @@ struct mgmt_frame_regs { * @tdls_oper: Perform a high-level TDLS operation (e.g. TDLS link setup). * * @probe_peer: probe a connected peer (AP: STA MAC required; STA: no MAC), - * must return a cookie that is later passed to cfg80211_probe_status(). + * must use the @cookie as provided which is later passed to + * cfg80211_probe_status(). * * @set_noack_map: Set the NoAck Map for the TIDs. * @@ -5219,7 +5220,8 @@ struct mgmt_frame_regs { * user space * * @tx_control_port: TX a control port frame (EAPoL). The noencrypt parameter - * tells the driver that the frame should not be encrypted. + * tells the driver that the frame should not be encrypted. A @cookie + * value of 0 means the caller does not want TX status reporting. * * @get_ftm_responder_stats: Retrieve FTM responder statistics, if available. * Statistics should be cumulative, currently no way to reset is provided. @@ -5456,14 +5458,14 @@ struct cfg80211_ops { struct wireless_dev wdev, struct ieee80211_channel chan, unsigned int duration, - u64 cookie, const u8 rx_addr); + u64 cookie, const u8 rx_addr); int (cancel_remain_on_channel)(struct wiphy wiphy, struct wireless_dev wdev, u64 cookie); int (mgmt_tx)(struct wiphy wiphy, struct wireless_dev wdev, struct cfg80211_mgmt_tx_params params, - u64 cookie); + u64 cookie); int (mgmt_tx_cancel_wait)(struct wiphy wiphy, struct wireless_dev wdev, u64 cookie); @@ -5510,7 +5512,7 @@ struct cfg80211_ops { const u8 peer, enum nl80211_tdls_operation oper); int (probe_peer)(struct wiphy wiphy, struct net_device dev, - const u8 peer, u64 cookie); + const u8 peer, u64 cookie); int (set_noack_map)(struct wiphy wiphy, struct net_device dev, @@ -5608,7 +5610,7 @@ struct cfg80211_ops { const u8 buf, size_t len, const u8 dest, const __be16 proto, const bool noencrypt, int link_id, - u64 cookie); + u64 cookie); int (get_ftm_responder_stats)(struct wiphy wiphy, struct net_device dev, diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index 0a9247be26afa..0c2c7afd59c4a 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -4831,19 +4831,6 @@ int ieee80211_channel_switch(struct wiphy wiphy, struct net_device dev, return __ieee80211_channel_switch(wiphy, dev, params); } -u64 ieee80211_mgmt_tx_cookie(struct ieee80211_local local) -{ - lockdep_assert_wiphy(local->hw.wiphy); - - local->roc_cookie_counter++; - - / wow, you wrapped 64 bits ... more likely a bug / - if (WARN_ON(local->roc_cookie_counter == 0)) - local->roc_cookie_counter++; - - return local->roc_cookie_counter; -} - int ieee80211_attach_ack_skb(struct ieee80211_local local, struct sk_buff skb, u64 cookie, gfp_t gfp) { @@ -4868,7 +4855,6 @@ int ieee80211_attach_ack_skb(struct ieee80211_local local, struct sk_buff skb, IEEE80211_SKB_CB(skb)->status_data_idr = 1; IEEE80211_SKB_CB(skb)->status_data = id; - cookie = ieee80211_mgmt_tx_cookie(local); IEEE80211_SKB_CB(ack_skb)->ack.cookie = cookie; return 0; @@ -4954,7 +4940,7 @@ static int ieee80211_set_rekey_data(struct wiphy wiphy, } static int ieee80211_probe_peer(struct wiphy wiphy, struct net_device dev, - const u8 peer, u64 cookie) + const u8 peer, u64 cookie) { struct ieee80211_sub_if_data sdata = IEEE80211_DEV_TO_SUB_IF(dev); struct ieee80211_local local = sdata->local; @@ -5061,7 +5047,7 @@ static int ieee80211_probe_peer(struct wiphy wiphy, struct net_device dev, if (qos) nullfunc->qos_ctrl = cpu_to_le16(7); - ret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_ATOMIC); + ret = ieee80211_attach_ack_skb(local, skb, &cookie, GFP_ATOMIC); if (ret) { kfree_skb(skb); return ret; diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h index a1ef88fe846dd..5761e96214914 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -1710,8 +1710,6 @@ struct ieee80211_local { struct list_head roc_list; struct wiphy_work hw_roc_start, hw_roc_done; unsigned long hw_roc_start_time; - u64 roc_cookie_counter; - struct idr ack_status_frames; spinlock_t ack_status_lock; @@ -1991,7 +1989,6 @@ u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data sdata); void ieee80211_handle_queued_frames(struct ieee80211_local local); -u64 ieee80211_mgmt_tx_cookie(struct ieee80211_local local); int ieee80211_attach_ack_skb(struct ieee80211_local local, struct sk_buff skb, u64 cookie, gfp_t gfp); @@ -2153,12 +2150,12 @@ void ieee80211_roc_purge(struct ieee80211_local local, struct ieee80211_sub_if_data sdata); int ieee80211_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev, struct ieee80211_channel chan, - unsigned int duration, u64 cookie, + unsigned int duration, u64 cookie, const u8 rx_addr); int ieee80211_cancel_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev, u64 cookie); int ieee80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, - struct cfg80211_mgmt_tx_params params, u64 cookie); + struct cfg80211_mgmt_tx_params params, u64 cookie); int ieee80211_mgmt_tx_cancel_wait(struct wiphy wiphy, struct wireless_dev wdev, u64 cookie); @@ -2237,7 +2234,7 @@ void __ieee80211_subif_start_xmit(struct sk_buff skb, struct net_device dev, u32 info_flags, u32 ctrl_flags, - u64 cookie); + u64 cookie); struct sk_buff ieee80211_build_data_template(struct ieee80211_sub_if_data sdata, struct sk_buff skb, u32 info_flags); @@ -2251,7 +2248,7 @@ void ieee80211_clear_fast_xmit(struct sta_info sta); int ieee80211_tx_control_port(struct wiphy wiphy, struct net_device dev, const u8 buf, size_t len, const u8 dest, __be16 proto, bool unencrypted, - int link_id, u64 cookie); + int link_id, u64 cookie); int ieee80211_probe_mesh_link(struct wiphy wiphy, struct net_device dev, const u8 buf, size_t len); void __ieee80211_xmit_fast(struct ieee80211_sub_if_data sdata, diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c index 2bceb73717c66..7acef80d5f1fb 100644 --- a/net/mac80211/offchannel.c +++ b/net/mac80211/offchannel.c @@ -602,14 +602,12 @@ static int ieee80211_start_roc_work(struct ieee80211_local local, / * cookie is either the roc cookie (for normal roc) - * or the SKB (for mgmt TX) + * or the mgmt_tx cookie; both are pre-assigned by cfg80211 / - if (!txskb) { - roc->cookie = ieee80211_mgmt_tx_cookie(local); - cookie = roc->cookie; - } else { + if (!txskb) + roc->cookie = cookie; + else roc->mgmt_tx_cookie = cookie; - } req = wiphy_dereference(local->hw.wiphy, local->scan_req); @@ -704,7 +702,7 @@ static int ieee80211_start_roc_work(struct ieee80211_local local, int ieee80211_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev, struct ieee80211_channel chan, - unsigned int duration, u64 cookie, + unsigned int duration, u64 cookie, const u8 rx_addr) { struct ieee80211_sub_if_data sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); @@ -713,7 +711,7 @@ int ieee80211_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev, lockdep_assert_wiphy(local->hw.wiphy); return ieee80211_start_roc_work(local, sdata, chan, - duration, cookie, NULL, + duration, &cookie, NULL, IEEE80211_ROC_TYPE_NORMAL); } @@ -810,7 +808,7 @@ int ieee80211_cancel_remain_on_channel(struct wiphy wiphy, } int ieee80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, - struct cfg80211_mgmt_tx_params params, u64 cookie) + struct cfg80211_mgmt_tx_params params, u64 cookie) { struct ieee80211_sub_if_data sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); struct ieee80211_local local = sdata->local; @@ -1016,18 +1014,11 @@ int ieee80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, / make a copy to preserve the frame contents * in case of encryption. / - ret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_KERNEL); + ret = ieee80211_attach_ack_skb(local, skb, &cookie, GFP_KERNEL); if (ret) { kfree_skb(skb); goto out_unlock; } - } else { - / Assign a dummy non-zero cookie, it's not sent to - * userspace in this case but we rely on its value - * internally in the need_offchan case to distinguish - * mgmt-tx from remain-on-channel. - / - cookie = 0xffffffff; } if (!need_offchan) { @@ -1044,7 +1035,7 @@ int ieee80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev, /* This will handle all kinds of coalescing and immediate TX / ret = ieee80211_start_roc_work(local, sdata, params->chan, - params->wait, cookie, skb, + params->wait, &cookie, skb, IEEE80211_ROC_TYPE_MGMT_TX); if (ret) ieee80211_free_txskb(&local->hw, skb); diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c index ffd575a8d188f..dc2f662fe4c46 100644 --- a/net/mac80211/tdls.c +++ b/net/mac80211/tdls.c @@ -1121,7 +1121,7 @@ ieee80211_tdls_prep_mgmt_packet(struct wiphy wiphy, struct net_device dev, / disable bottom halves when entering the Tx path / local_bh_disable(); __ieee80211_subif_start_xmit(skb, dev, flags, - IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, NULL); + IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, 0); local_bh_enable(); return ret; diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 0cf5f6ec75e67..454a872b259a3 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -2583,7 +2583,7 @@ int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data sdata, static u16 ieee80211_store_ack_skb(struct ieee80211_local local, struct sk_buff skb, u32 info_flags, - u64 cookie) + u64 cookie) { struct sk_buff ack_skb; u16 info_id = 0; @@ -2605,10 +2605,8 @@ static u16 ieee80211_store_ack_skb(struct ieee80211_local local, if (id >= 0) { info_id = id; info_flags \|= IEEE80211_TX_CTL_REQ_TX_STATUS; - if (cookie) { - cookie = ieee80211_mgmt_tx_cookie(local); - IEEE80211_SKB_CB(ack_skb)->ack.cookie = cookie; - } + if (cookie) + IEEE80211_SKB_CB(ack_skb)->ack.cookie = cookie; } else { kfree_skb(ack_skb); } @@ -2653,7 +2651,7 @@ static void ieee80211_remove_ack_skb(struct ieee80211_local local, u16 info_id) static struct sk_buff ieee80211_build_hdr(struct ieee80211_sub_if_data sdata, struct sk_buff skb, u32 info_flags, struct sta_info sta, u32 ctrl_flags, - u64 cookie) + u64 cookie) { struct ieee80211_local local = sdata->local; struct ieee80211_tx_info info; @@ -4374,7 +4372,7 @@ void __ieee80211_subif_start_xmit(struct sk_buff skb, struct net_device dev, u32 info_flags, u32 ctrl_flags, - u64 cookie) + u64 cookie) { struct ieee80211_sub_if_data sdata = IEEE80211_DEV_TO_SUB_IF(dev); struct ieee80211_local local = sdata->local; @@ -4569,7 +4567,7 @@ static void ieee80211_mlo_multicast_tx_one(struct ieee80211_sub_if_data sdata, return; ctrl_flags \|= u32_encode_bits(link_id, IEEE80211_TX_CTRL_MLO_LINK); - __ieee80211_subif_start_xmit(out, sdata->dev, 0, ctrl_flags, NULL); + __ieee80211_subif_start_xmit(out, sdata->dev, 0, ctrl_flags, 0); } static void ieee80211_mlo_multicast_tx(struct net_device dev, @@ -4584,8 +4582,7 @@ static void ieee80211_mlo_multicast_tx(struct net_device dev, ctrl_flags \|= u32_encode_bits(__ffs(links), IEEE80211_TX_CTRL_MLO_LINK); - __ieee80211_subif_start_xmit(skb, sdata->dev, 0, ctrl_flags, - NULL); + __ieee80211_subif_start_xmit(skb, sdata->dev, 0, ctrl_flags, 0); return; } @@ -4627,7 +4624,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff skb, while ((skb = __skb_dequeue(&queue))) __ieee80211_subif_start_xmit(skb, dev, 0, IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, - NULL); + 0); } else if (ieee80211_vif_is_mld(&sdata->vif) && ((sdata->vif.type == NL80211_IFTYPE_AP && !ieee80211_hw_check(&sdata->local->hw, MLO_MCAST_MULTI_LINK_TX)) \|\| @@ -4638,7 +4635,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff skb, normal: __ieee80211_subif_start_xmit(skb, dev, 0, IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, - NULL); + 0); } return NETDEV_TX_OK; @@ -4737,7 +4734,7 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data sdata, /* fall back to non-offload slow path / __ieee80211_subif_start_xmit(skb, dev, 0, IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, - NULL); + 0); return; } @@ -4773,7 +4770,7 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data sdata, if (unlikely(sk_requests_wifi_status(skb->sk))) { info->status_data = ieee80211_store_ack_skb(local, skb, - &info->flags, NULL); + &info->flags, 0); if (info->status_data) info->status_data_idr = 1; } @@ -4916,7 +4913,7 @@ ieee80211_build_data_template(struct ieee80211_sub_if_data sdata, } skb = ieee80211_build_hdr(sdata, skb, info_flags, sta, - IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, NULL); + IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, 0); if (IS_ERR(skb)) goto out; @@ -6531,7 +6528,7 @@ void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data sdata, int ieee80211_tx_control_port(struct wiphy wiphy, struct net_device dev, const u8 buf, size_t len, const u8 dest, __be16 proto, bool unencrypted, - int link_id, u64 cookie) + int link_id, u64 cookie) { struct ieee80211_sub_if_data sdata = IEEE80211_DEV_TO_SUB_IF(dev); struct ieee80211_local local = sdata->local; @@ -6666,7 +6663,7 @@ int ieee80211_probe_mesh_link(struct wiphy wiphy, struct net_device dev, local_bh_disable(); __ieee80211_subif_start_xmit(skb, skb->dev, 0, IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP, - NULL); + 0); local_bh_enable(); return 0; diff --git a/net/wireless/core.h b/net/wireless/core.h index 15d9f7eb58b4d..b4610f6685dcb 100644 --- a/net/wireless/core.h +++ b/net/wireless/core.h @@ -402,7 +402,7 @@ void cfg80211_mlme_purge_registrations(struct wireless_dev wdev); int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device rdev, struct wireless_dev wdev, struct cfg80211_mgmt_tx_params params, - u64 cookie); + u64 cookie); void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap ht_capa, const struct ieee80211_ht_cap ht_capa_mask); void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap vht_capa, diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c index 7824b7ac2770f..a0d1cde26f0c9 100644 --- a/net/wireless/mlme.c +++ b/net/wireless/mlme.c @@ -894,7 +894,7 @@ static bool cfg80211_allowed_random_address(struct wireless_dev wdev, int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device rdev, struct wireless_dev wdev, - struct cfg80211_mgmt_tx_params params, u64 cookie) + struct cfg80211_mgmt_tx_params params, u64 cookie) { const struct ieee80211_mgmt mgmt; u16 stype; diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 8adbef5f04425..ac895e02cd411 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -14642,8 +14642,9 @@ static int nl80211_remain_on_channel(struct sk_buff skb, goto free_msg; } + cookie = cfg80211_assign_cookie(rdev); err = rdev_remain_on_channel(rdev, wdev, chandef.chan, - duration, &cookie, rx_addr); + duration, cookie, rx_addr); if (err) goto free_msg; @@ -14883,7 +14884,8 @@ static int nl80211_tx_mgmt(struct sk_buff skb, struct genl_info info) } params.chan = chandef.chan; - err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie); + cookie = cfg80211_assign_cookie(rdev); + err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, cookie); if (err) goto free_msg; @@ -16371,7 +16373,8 @@ static int nl80211_probe_peer(struct sk_buff skb, struct genl_info info) goto free_msg; } - err = rdev_probe_peer(rdev, dev, addr, &cookie); + cookie = cfg80211_assign_cookie(rdev); + err = rdev_probe_peer(rdev, dev, addr, cookie); if (err) goto free_msg; @@ -18586,10 +18589,11 @@ static int nl80211_tx_control_port(struct sk_buff skb, struct genl_info info) link_id = nl80211_link_id_or_invalid(info->attrs); + cookie = dont_wait_for_ack ? 0 : cfg80211_assign_cookie(rdev); err = rdev_tx_control_port(rdev, dev, buf, len, dest, cpu_to_be16(proto), noencrypt, link_id, - dont_wait_for_ack ? NULL : &cookie); - if (!err && !dont_wait_for_ack) + cookie); + if (!err && cookie) nl_set_extack_cookie_u64(info->extack, cookie); return err; } @@ -22042,6 +22046,10 @@ static void nl80211_frame_tx_status(struct wireless_dev wdev, struct sk_buff msg; void hdr; + /* userspace not interested in zero-cookie status / + if (!status->cookie) + return; + if (command == NL80211_CMD_FRAME_TX_STATUS) trace_cfg80211_mgmt_tx_status(wdev, status->cookie, status->ack); diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h index 6c3bad8b2d6f6..46849fe8d0b39 100644 --- a/net/wireless/rdev-ops.h +++ b/net/wireless/rdev-ops.h @@ -736,14 +736,14 @@ static inline int rdev_remain_on_channel(struct cfg80211_registered_device rdev, struct wireless_dev wdev, struct ieee80211_channel chan, - unsigned int duration, u64 cookie, const u8 rx_addr) + unsigned int duration, u64 cookie, const u8 rx_addr) { int ret; trace_rdev_remain_on_channel(&rdev->wiphy, wdev, chan, duration, rx_addr); ret = rdev->ops->remain_on_channel(&rdev->wiphy, wdev, chan, duration, cookie, rx_addr); - trace_rdev_return_int_cookie(&rdev->wiphy, ret, cookie); + trace_rdev_return_int_cookie(&rdev->wiphy, ret, cookie); return ret; } @@ -761,12 +761,12 @@ rdev_cancel_remain_on_channel(struct cfg80211_registered_device rdev, static inline int rdev_mgmt_tx(struct cfg80211_registered_device rdev, struct wireless_dev wdev, struct cfg80211_mgmt_tx_params params, - u64 cookie) + u64 cookie) { int ret; trace_rdev_mgmt_tx(&rdev->wiphy, wdev, params); ret = rdev->ops->mgmt_tx(&rdev->wiphy, wdev, params, cookie); - trace_rdev_return_int_cookie(&rdev->wiphy, ret, cookie); + trace_rdev_return_int_cookie(&rdev->wiphy, ret, cookie); return ret; } @@ -775,7 +775,7 @@ static inline int rdev_tx_control_port(struct cfg80211_registered_device rdev, const void buf, size_t len, const u8 dest, __be16 proto, const bool noencrypt, int link, - u64 cookie) + u64 cookie) { int ret; trace_rdev_tx_control_port(&rdev->wiphy, dev, buf, len, @@ -783,7 +783,7 @@ static inline int rdev_tx_control_port(struct cfg80211_registered_device rdev, ret = rdev->ops->tx_control_port(&rdev->wiphy, dev, buf, len, dest, proto, noencrypt, link, cookie); if (cookie) - trace_rdev_return_int_cookie(&rdev->wiphy, ret, cookie); + trace_rdev_return_int_cookie(&rdev->wiphy, ret, cookie); else trace_rdev_return_int(&rdev->wiphy, ret); return ret; @@ -950,12 +950,12 @@ static inline int rdev_tdls_oper(struct cfg80211_registered_device rdev, static inline int rdev_probe_peer(struct cfg80211_registered_device rdev, struct net_device dev, const u8 peer, - u64 cookie) + u64 cookie) { int ret; trace_rdev_probe_peer(&rdev->wiphy, dev, peer); ret = rdev->ops->probe_peer(&rdev->wiphy, dev, peer, cookie); - trace_rdev_return_int_cookie(&rdev->wiphy, ret, cookie); + trace_rdev_return_int_cookie(&rdev->wiphy, ret, cookie); return ret; }
3/2	2026/08/01 19:22	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 23709 output: 24 thoughts: 599 Thoughts: Cookie Handling Refactor in cfg80211/mac80211 Okay, so I'm looking at this patch and it looks like a fairly significant change to how cookies are handled in several cfg80211/mac80211 functions. Specifically, they're moving from passing a `u64 *cookie` (a pointer to a cookie) to a `u64 cookie` (passing the cookie by value) in several key functions. Functions affected include `remain_on_channel`, `mgmt_tx`, `probe_peer`, and `tx_control_port`. The changes are quite widespread; the patch touches a bunch of drivers: ath6kl, wil6210, brcmfmac, mwifiex, wilc1000, nxpwifi, qtnfmac, rtl8723bs, and also the core `cfg80211.h`, mac80211 (cfg.c, offchannel.c, tdls.c, tx.c), and wireless core headers. The files include `core.h`, `mlme.c`, `nl80211.c`, and `rdev-ops.h`. This is a functional change, definitely not just a cosmetic one, because it fundamentally alters how cookies are generated and passed around. The old way, the drivers or mac80211 would generate the cookie and then use the pointer to send it back. The new way? `nl80211` is now responsible for generating the cookie using `cfg80211_assign_cookie(rdev)` and then passing it by value to the drivers/mac80211. Wait a second, let me just pause and quickly check something. `cfg80211_assign_cookie`... is that a brand new function? I should probably take a look at it to see how it works. Let's do a quick grep for `cfg80211_assign_cookie` to make sure it exists, and to understand its scope. It's important to understand how these core helper functions operate.
4/2	2026/08/01 19:22	tool	grepper	0m Args: { "Expression": "cfg80211_assign_cookie" } Results: { "Output": "net/wireless/core.h=137=cfg80211_rdev_free_wowlan(struct cfg80211_registered_device rdev)\n--\nnet/wireless/core.h-155-\nnet/wireless/core.h:156:static inline u64 cfg80211_assign_cookie(struct cfg80211_registered_device rdev)\nnet/wireless/core.h-157-{\n--\nnet/wireless/nl80211.c=11952=static int nl80211_start_sched_scan(struct sk_buff skb,\n--\nnet/wireless/nl80211.c-11981-\tif (want_multi \u0026\u0026 rdev-\u003ewiphy.max_sched_scan_reqs \u003e 1)\nnet/wireless/nl80211.c:11982:\t\tsched_scan_req-\u003ereqid = cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c-11983-\n--\nnet/wireless/nl80211.c=14570=static int nl80211_remain_on_channel(struct sk_buff skb,\n--\nnet/wireless/nl80211.c-14644-\nnet/wireless/nl80211.c:14645:\tcookie = cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c-14646-\terr = rdev_remain_on_channel(rdev, wdev, chandef.chan,\n--\nnet/wireless/nl80211.c=14764=static int nl80211_tx_mgmt(struct sk_buff skb, struct genl_info info)\n--\nnet/wireless/nl80211.c-14886-\tparams.chan = chandef.chan;\nnet/wireless/nl80211.c:14887:\tcookie = cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c-14888-\terr = cfg80211_mlme_mgmt_tx(rdev, wdev, \u0026params, cookie);\n--\nnet/wireless/nl80211.c=16328=static int nl80211_probe_peer(struct sk_buff skb, struct genl_info info)\n--\nnet/wireless/nl80211.c-16375-\nnet/wireless/nl80211.c:16376:\tcookie = cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c-16377-\terr = rdev_probe_peer(rdev, dev, addr, cookie);\n--\nnet/wireless/nl80211.c=16806=static int nl80211_nan_add_func(struct sk_buff skb,\n--\nnet/wireless/nl80211.c-16836-\nnet/wireless/nl80211.c:16837:\tfunc-\u003ecookie = cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c-16838-\n--\nnet/wireless/nl80211.c=18536=static int nl80211_tx_control_port(struct sk_buff skb, struct genl_info info)\n--\nnet/wireless/nl80211.c-18591-\nnet/wireless/nl80211.c:18592:\tcookie = dont_wait_for_ack ? 0 : cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c-18593-\terr = rdev_tx_control_port(rdev, dev, buf, len,\n--\nnet/wireless/pmsr.c=414=int nl80211_pmsr_start(struct sk_buff skb, struct genl_info *info)\n--\nnet/wireless/pmsr.c-521-\t}\nnet/wireless/pmsr.c:522:\treq-\u003ecookie = cfg80211_assign_cookie(rdev);\nnet/wireless/pmsr.c-523-\treq-\u003enl_portid = info-\u003esnd_portid;\n" }
5/2	2026/08/01 19:22	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 25964 output: 25 thoughts: 342 Thoughts: Wireless Stack API Change Review Alright, let's break this down. This patch is hitting the core of the wireless stack, specifically the `cfg80211` and `mac80211` APIs for `remain_on_channel`, `mgmt_tx`, `probe_peer`, and `tx_control_port`. That's a functional change, not just a cosmetic one, meaning it's how we handle cookies and pass them up to userspace. Definitely, fuzzing is going to be crucial here to ensure we haven't introduced any vulnerabilities or unexpected behavior changes. The key symbols to keep an eye on are the `nl80211_` and `ieee80211_` variations of those functions. They're the entry points from netlink and the core mac80211 stack, respectively. We need to be especially mindful of the interactions and cookie handling between these points. As for configuration, `CONFIG_MAC80211` and `CONFIG_CFG80211` are the obvious ones. Beyond that, while `CONFIG_NL80211_TESTMODE` might provide some useful debugging capabilities, it's not strictly required for these core nl80211 commands. Now, this is interesting...QEMU can emulate `mac80211_hwsim`. That makes testing a lot easier. So, to ensure a solid testing environment, we absolutely need `CONFIG_MAC80211_HWSIM` enabled. That will give us a controlled environment to put the patch through its paces.
6/2	2026/08/01 19:22	tool	grepper	0m Args: { "Expression": "config MAC80211_HWSIM" } Results: { "Output": "drivers/net/wireless/virtual/Kconfig:1:config MAC80211_HWSIM\ndrivers/net/wireless/virtual/Kconfig-2-\ttristate \"Simulated radio testing tool for mac80211\"\n" }
7/2	2026/08/01 19:22	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 26747 output: 36 thoughts: 31 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Investigating the MAC80211_HWSIM Kconfig Dependencies Alright, I need to get a handle on the dependencies of `MAC80211_HWSIM`. Time to dive into `drivers/net/wireless/virtual/Kconfig`. I know this is where the configuration options for this virtual hardware simulation reside. I expect to find the standard `depends on` statements in there. I'm looking for clues about other features or drivers it might be linked to. This will help me understand what features it enables and potentially what other configurations might become relevant. This is a common first step when investigating how a complex feature like `MAC80211_HWSIM` integrates with the wider kernel network stack.
8/2	2026/08/01 19:23	tool	read-file	0m Args: { "File": "drivers/net/wireless/virtual/Kconfig", "FirstLine": 1, "LineCount": 20 } Results: { "Contents": " 1:\tconfig MAC80211_HWSIM\n 2:\t\ttristate \"Simulated radio testing tool for mac80211\"\n 3:\t\tdepends on MAC80211\n 4:\t\thelp\n 5:\t\t This driver is a developer testing tool that can be used to test\n 6:\t\t IEEE 802.11 networking stack (mac80211) functionality. This is not\n 7:\t\t needed for normal wireless LAN usage and is only for testing. See\n 8:\t\t Documentation/networking/mac80211_hwsim for more information on how\n 9:\t\t to use this tool.\n 10:\t\n 11:\t\t To compile this driver as a module, choose M here: the module will be\n 12:\t\t called mac80211_hwsim. If unsure, say N.\n 13:\t\n 14:\tconfig VIRT_WIFI\n 15:\t\ttristate \"Wifi wrapper for ethernet drivers\"\n 16:\t\tdepends on CFG80211\n 17:\t\thelp\n 18:\t\t This option adds support for ethernet connections to appear as if they\n 19:\t\t are wifi connections through a special rtnetlink device.\n 20:\t\n" }
9/2	2026/08/01 19:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 27314 output: 27 thoughts: 368 Thoughts: My Analysis of the Wireless Patch Okay, so I'm looking at this patch and immediately see the dependency chain: `MAC80211_HWSIM` relies on `MAC80211`, which in turn relies on `CFG80211`. That means for this to work, I'll need to ensure all three are enabled: `CFG80211`, `MAC80211`, and `MAC80211_HWSIM`. That's the baseline. Now, let's dig a little deeper. This patch is touching the core of `cfg80211` and `mac80211`, which makes me think it's functional. These changes are definitely accessible through `nl80211`, which is promising. The fact that the patch also touches various drivers is concerning because I can't possibly test them all in a QEMU environment. However, the use of `mac80211_hwsim` is a smart move. It should exercise the `mac80211` and `cfg80211` paths, which are the primary focus of this. To make sure I'm following everything, I need to focus on these symbols: `nl80211_remain_on_channel`, `nl80211_tx_mgmt`, `nl80211_probe_peer`, `nl80211_tx_control_port`, `cfg80211_mlme_mgmt_tx`, `ieee80211_remain_on_channel`, `ieee80211_mgmt_tx`, `ieee80211_probe_peer`, and `ieee80211_tx_control_port`. I need to be sure that these functions and the names are correct. I'll need to go back and verify `ieee80211_tx_control_port`.
10/2	2026/08/01 19:23	tool	grepper	0m Args: { "Expression": "ieee80211_tx_control_port" } Results: { "Output": "net/mac80211/cfg.c=5974=const struct cfg80211_ops mac80211_config_ops = {\n--\nnet/mac80211/cfg.c-6068-\t.set_multicast_to_unicast = ieee80211_set_multicast_to_unicast,\nnet/mac80211/cfg.c:6069:\t.tx_control_port = ieee80211_tx_control_port,\nnet/mac80211/cfg.c-6070-\t.get_txq_stats = ieee80211_get_txq_stats,\n--\nnet/mac80211/ieee80211_i.h=2247=void ieee80211_clear_fast_xmit(struct sta_info sta);\nnet/mac80211/ieee80211_i.h:2248:int ieee80211_tx_control_port(struct wiphy wiphy, struct net_device dev,\nnet/mac80211/ieee80211_i.h-2249-\t\t\t const u8 buf, size_t len,\n--\nnet/mac80211/tx.c=2651=static struct sk_buff ieee80211_build_hdr(struct ieee80211_sub_if_data sdata,\n--\nnet/mac80211/tx.c-3050-\t\t * ctrl_flags already have been set by\nnet/mac80211/tx.c:3051:\t\t * ieee80211_tx_control_port(), here\nnet/mac80211/tx.c-3052-\t\t * we just sanity check that\n--\nnet/mac80211/tx.c=6497=void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data sdata,\n--\nnet/mac80211/tx.c-6527-\nnet/mac80211/tx.c:6528:int ieee80211_tx_control_port(struct wiphy wiphy, struct net_device dev,\nnet/mac80211/tx.c-6529-\t\t\t const u8 buf, size_t len,\n" }
11/2	2026/08/01 19:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 28789 output: 25 thoughts: 24 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Confirming and Refining a Hypothesis Okay, so the initial assessment feels correct. Yes, it is. But, let's not rush to conclusions. I need to be absolutely certain before proceeding. This is critical. To be thorough, let's immediately and specifically go back and rigorously examine the implementation of `ieee80211_probe_peer`. I want to drill down into the core function that's at the heart of the matter. Double-checking is crucial here. I need to refresh my memory of the exact logic within that probe function. I'm going to look at the edge cases, and all possible sources of error. No stone unturned.
12/2	2026/08/01 19:23	tool	grepper	0m Args: { "Expression": "ieee80211_probe_peer" } Results: { "Output": "net/mac80211/cfg.c=4927=static int ieee80211_set_rekey_data(struct wiphy wiphy,\n--\nnet/mac80211/cfg.c-4941-\nnet/mac80211/cfg.c:4942:static int ieee80211_probe_peer(struct wiphy wiphy, struct net_device dev,\nnet/mac80211/cfg.c-4943-\t\t\t\tconst u8 peer, u64 cookie)\n--\nnet/mac80211/cfg.c=5974=const struct cfg80211_ops mac80211_config_ops = {\n--\nnet/mac80211/cfg.c-6049-\t.tdls_cancel_channel_switch = ieee80211_tdls_cancel_channel_switch,\nnet/mac80211/cfg.c:6050:\t.probe_peer = ieee80211_probe_peer,\nnet/mac80211/cfg.c-6051-\t.set_noack_map = ieee80211_set_noack_map,\n" }
13/2	2026/08/01 19:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 29326 output: 25 thoughts: 24 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Confirming and Cross-Referencing Yes, that's correct, no surprises there. My initial assessment is holding. But, just to be absolutely certain, and to solidify my understanding, let me quickly double-check the `ieee80211_mgmt_tx` function. I want to quickly refresh my understanding of how this particular mechanism handles the transaction. No need to leave any stone unturned when dealing with low level systems. I need to refresh the inner workings of this function in my mind to proceed with the next step.
14/2	2026/08/01 19:23	tool	grepper	0m Args: { "Expression": "ieee80211_mgmt_tx" } Results: { "Output": "net/mac80211/cfg.c=5974=const struct cfg80211_ops mac80211_config_ops = {\n--\nnet/mac80211/cfg.c-6036-\t.cancel_remain_on_channel = ieee80211_cancel_remain_on_channel,\nnet/mac80211/cfg.c:6037:\t.mgmt_tx = ieee80211_mgmt_tx,\nnet/mac80211/cfg.c:6038:\t.mgmt_tx_cancel_wait = ieee80211_mgmt_tx_cancel_wait,\nnet/mac80211/cfg.c-6039-\t.set_cqm_rssi_config = ieee80211_set_cqm_rssi_config,\n--\nnet/mac80211/ieee80211_i.h=2155=int ieee80211_cancel_remain_on_channel(struct wiphy wiphy,\nnet/mac80211/ieee80211_i.h-2156-\t\t\t\t struct wireless_dev wdev, u64 cookie);\nnet/mac80211/ieee80211_i.h:2157:int ieee80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\nnet/mac80211/ieee80211_i.h-2158-\t\t struct cfg80211_mgmt_tx_params params, u64 cookie);\nnet/mac80211/ieee80211_i.h:2159:int ieee80211_mgmt_tx_cancel_wait(struct wiphy wiphy,\nnet/mac80211/ieee80211_i.h-2160-\t\t\t\t struct wireless_dev wdev, u64 cookie);\n--\nnet/mac80211/offchannel.c=801=int ieee80211_cancel_remain_on_channel(struct wiphy wiphy,\n--\nnet/mac80211/offchannel.c-809-\nnet/mac80211/offchannel.c:810:int ieee80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,\nnet/mac80211/offchannel.c-811-\t\t struct cfg80211_mgmt_tx_params params, u64 cookie)\n--\nnet/mac80211/offchannel.c-1045-\nnet/mac80211/offchannel.c:1046:int ieee80211_mgmt_tx_cancel_wait(struct wiphy wiphy,\nnet/mac80211/offchannel.c-1047-\t\t\t\t struct wireless_dev *wdev, u64 cookie)\n" }
15/2	2026/08/01 19:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 30288 output: 27 thoughts: 26 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: Double-Checking the `ieee80211_remain_on_channel` Function Okay, yes, that seems right. But before I move on, I need to be absolutely certain. Let me just quickly run through the details again. I'm going to double-check the implementation of `ieee80211_remain_on_channel`. It's a critical function, and a subtle bug here could have cascading and nasty implications down the line. It's too important to gloss over, even if my initial assessment suggested everything was in order. I'm going to make sure I'm solid on the nuances and any potential edge cases before I finalize my conclusions.
16/2	2026/08/01 19:23	tool	grepper	0m Args: { "Expression": "ieee80211_remain_on_channel" } Results: { "Output": "drivers/net/wireless/ath/ath10k/mac.c=4521=void __ath10k_scan_finish(struct ath10k ar)\n--\ndrivers/net/wireless/ath/ath10k/mac.c-4530-\t\tif (ar-\u003escan.is_roc \u0026\u0026 ar-\u003escan.roc_notify)\ndrivers/net/wireless/ath/ath10k/mac.c:4531:\t\t\tieee80211_remain_on_channel_expired(ar-\u003ehw);\ndrivers/net/wireless/ath/ath10k/mac.c-4532-\t\tfallthrough;\n--\ndrivers/net/wireless/ath/ath11k/mac.c=3866=void __ath11k_mac_scan_finish(struct ath11k ar)\n--\ndrivers/net/wireless/ath/ath11k/mac.c-3875-\t\tif (ar-\u003escan.is_roc \u0026\u0026 ar-\u003escan.roc_notify)\ndrivers/net/wireless/ath/ath11k/mac.c:3876:\t\t\tieee80211_remain_on_channel_expired(ar-\u003ehw);\ndrivers/net/wireless/ath/ath11k/mac.c-3877-\t\tfallthrough;\n--\ndrivers/net/wireless/ath/ath12k/mac.c=5161=void __ath12k_mac_scan_finish(struct ath12k ar)\n--\ndrivers/net/wireless/ath/ath12k/mac.c-5172-\t\tif (ar-\u003escan.is_roc \u0026\u0026 ar-\u003escan.roc_notify)\ndrivers/net/wireless/ath/ath12k/mac.c:5173:\t\t\tieee80211_remain_on_channel_expired(hw);\ndrivers/net/wireless/ath/ath12k/mac.c-5174-\t\tfallthrough;\n--\ndrivers/net/wireless/ath/ath9k/channel.c=934=void ath_roc_complete(struct ath_softc sc, enum ath_roc_complete_reason reason)\n--\ndrivers/net/wireless/ath/ath9k/channel.c-943-\t\tath_dbg(common, CHAN_CTX, \"RoC aborted\\n\");\ndrivers/net/wireless/ath/ath9k/channel.c:944:\t\tieee80211_remain_on_channel_expired(sc-\u003ehw);\ndrivers/net/wireless/ath/ath9k/channel.c-945-\t\tbreak;\n--\ndrivers/net/wireless/ath/ath9k/channel.c-947-\t\tath_dbg(common, CHAN_CTX, \"RoC expired\\n\");\ndrivers/net/wireless/ath/ath9k/channel.c:948:\t\tieee80211_remain_on_channel_expired(sc-\u003ehw);\ndrivers/net/wireless/ath/ath9k/channel.c-949-\t\tbreak;\n--\ndrivers/net/wireless/intel/iwlwifi/mld/iface.c=20=void iwl_mld_cleanup_vif(void data, u8 mac, struct ieee80211_vif vif)\n--\ndrivers/net/wireless/intel/iwlwifi/mld/iface.c-34-\tif (mld_vif-\u003eroc_activity != ROC_NUM_ACTIVITIES)\ndrivers/net/wireless/intel/iwlwifi/mld/iface.c:35:\t\tieee80211_remain_on_channel_expired(mld-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mld/iface.c-36-\n--\ndrivers/net/wireless/intel/iwlwifi/mld/roc.c=225=void iwl_mld_handle_roc_notif(struct iwl_mld mld,\n--\ndrivers/net/wireless/intel/iwlwifi/mld/roc.c-258-\t\t /\ndrivers/net/wireless/intel/iwlwifi/mld/roc.c:259:\t\tieee80211_remain_on_channel_expired(mld-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mld/roc.c-260-\t}\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/mac80211.c=1130=void iwl_mvm_restart_cleanup(struct iwl_mvm mvm)\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/mac80211.c-1141-\tiwl_mvm_cleanup_roc_te(mvm);\ndrivers/net/wireless/intel/iwlwifi/mvm/mac80211.c:1142:\tieee80211_remain_on_channel_expired(mvm-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mvm/mac80211.c-1143-\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c=309=static void iwl_mvm_te_handle_notif(struct iwl_mvm mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-351-\t\tcase NL80211_IFTYPE_P2P_DEVICE:\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c:352:\t\t\tieee80211_remain_on_channel_expired(mvm-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-353-\t\t\tiwl_mvm_roc_finished(mvm);\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c=415=void iwl_mvm_rx_roc_notif(struct iwl_mvm mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-444-\t\tiwl_mvm_roc_finished(mvm);\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c:445:\t\tieee80211_remain_on_channel_expired(mvm-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-446-\t}\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c=452=static int iwl_mvm_aux_roc_te_handle_notif(struct iwl_mvm mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-475-\t\t/ End TE, notify mac80211 /\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c:476:\t\tieee80211_remain_on_channel_expired(mvm-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-477-\t\tiwl_mvm_roc_finished(mvm); / flush aux queue /\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c=945=void iwl_mvm_rx_session_protect_notif(struct iwl_mvm mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-1009-\t\tiwl_mvm_roc_finished(mvm);\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c:1010:\t\tieee80211_remain_on_channel_expired(mvm-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-1011-\t} else if (le32_to_cpu(notif-\u003estart)) {\n--\ndrivers/net/wireless/mediatek/mt76/channel.c=313=void mt76_roc_complete(struct mt76_phy phy)\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-331-\tif (!test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state))\ndrivers/net/wireless/mediatek/mt76/channel.c:332:\t\tieee80211_remain_on_channel_expired(phy-\u003ehw);\ndrivers/net/wireless/mediatek/mt76/channel.c-333-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c=1030=void mt7615_roc_work(struct work_struct work)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c-1044-\tmt7615_mutex_release(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c:1045:\tieee80211_remain_on_channel_expired(phy-\u003emt76-\u003ehw);\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c-1046-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c=387=void mt7921_roc_work(struct work_struct work)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-402-\tmt792x_mutex_release(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:403:\tieee80211_remain_on_channel_expired(phy-\u003emt76-\u003ehw);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-404-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=509=void mt7925_roc_work(struct work_struct work)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-523-\tmt792x_mutex_release(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:524:\tieee80211_remain_on_channel_expired(phy-\u003emt76-\u003ehw);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-525-}\n--\ndrivers/net/wireless/realtek/rtw89/core.c=5048=void rtw89_roc_end(struct rtw89_dev rtwdev, struct rtw89_vif rtwvif)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-5057-\ndrivers/net/wireless/realtek/rtw89/core.c:5058:\tieee80211_remain_on_channel_expired(hw);\ndrivers/net/wireless/realtek/rtw89/core.c-5059-\n--\ndrivers/net/wireless/rsi/rsi_91x_mac80211.c=1769=void rsi_roc_timeout(struct timer_list t)\n--\ndrivers/net/wireless/rsi/rsi_91x_mac80211.c-1775-\tmutex_lock(\u0026common-\u003emutex);\ndrivers/net/wireless/rsi/rsi_91x_mac80211.c:1776:\tieee80211_remain_on_channel_expired(common-\u003epriv-\u003ehw);\ndrivers/net/wireless/rsi/rsi_91x_mac80211.c-1777-\n--\ndrivers/net/wireless/silabs/wfx/scan.c=149=void wfx_remain_on_channel_work(struct work_struct work)\n--\ndrivers/net/wireless/silabs/wfx/scan.c-178-\t\tdev_err(wvif-\u003ewdev-\u003edev, \"roc didn't stop\\n\");\ndrivers/net/wireless/silabs/wfx/scan.c:179:\tieee80211_remain_on_channel_expired(wvif-\u003ewdev-\u003ehw);\ndrivers/net/wireless/silabs/wfx/scan.c-180-end:\n--\ndrivers/net/wireless/ti/wlcore/main.c=2712=static void __wl1271_op_remove_interface(struct wl1271 wl,\n--\ndrivers/net/wireless/ti/wlcore/main.c-2754-\t\twl-\u003eroc_vif = NULL;\ndrivers/net/wireless/ti/wlcore/main.c:2755:\t\tieee80211_remain_on_channel_expired(wl-\u003ehw);\ndrivers/net/wireless/ti/wlcore/main.c-2756-\t}\n--\ndrivers/net/wireless/ti/wlcore/main.c=5743=static void wlcore_roc_complete_work(struct work_struct work)\n--\ndrivers/net/wireless/ti/wlcore/main.c-5753-\tif (!ret)\ndrivers/net/wireless/ti/wlcore/main.c:5754:\t\tieee80211_remain_on_channel_expired(wl-\u003ehw);\ndrivers/net/wireless/ti/wlcore/main.c-5755-}\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=3307=static void hw_roc_done(struct work_struct work)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3312-\tmutex_lock(\u0026hwsim-\u003emutex);\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:3313:\tieee80211_remain_on_channel_expired(hwsim-\u003ehw);\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3314-\thwsim-\u003etmp_chan = NULL;\n--\ninclude/net/mac80211.h=4068=struct ieee80211_prep_tx_info {\n--\ninclude/net/mac80211.h-4451- \tduration (which will always be non-zero) expires, the driver must call\ninclude/net/mac80211.h:4452: \tieee80211_remain_on_channel_expired().\ninclude/net/mac80211.h-4453- \tNote that this callback may be called while the device is in IDLE and\n--\ninclude/net/mac80211.h=7168=void ieee80211_ready_on_channel(struct ieee80211_hw hw);\n--\ninclude/net/mac80211.h-7170-/\ninclude/net/mac80211.h:7171: ieee80211_remain_on_channel_expired - remain_on_channel duration expired\ninclude/net/mac80211.h-7172- * @hw: pointer as obtained from ieee80211_alloc_hw()\ninclude/net/mac80211.h-7173- /\ninclude/net/mac80211.h:7174:void ieee80211_remain_on_channel_expired(struct ieee80211_hw hw);\ninclude/net/mac80211.h-7175-\n--\nnet/mac80211/cfg.c=5974=const struct cfg80211_ops mac80211_config_ops = {\n--\nnet/mac80211/cfg.c-6034-\t.set_bitrate_mask = ieee80211_set_bitrate_mask,\nnet/mac80211/cfg.c:6035:\t.remain_on_channel = ieee80211_remain_on_channel,\nnet/mac80211/cfg.c-6036-\t.cancel_remain_on_channel = ieee80211_cancel_remain_on_channel,\n--\nnet/mac80211/ieee80211_i.h=2149=void ieee80211_roc_purge(struct ieee80211_local local,\nnet/mac80211/ieee80211_i.h-2150-\t\t\t struct ieee80211_sub_if_data sdata);\nnet/mac80211/ieee80211_i.h:2151:int ieee80211_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev,\nnet/mac80211/ieee80211_i.h-2152-\t\t\t\tstruct ieee80211_channel chan,\n--\nnet/mac80211/offchannel.c=496=static void ieee80211_hw_roc_done(struct wiphy wiphy, struct wiphy_work work)\n--\nnet/mac80211/offchannel.c-508-\nnet/mac80211/offchannel.c:509:void ieee80211_remain_on_channel_expired(struct ieee80211_hw hw)\nnet/mac80211/offchannel.c-510-{\n--\nnet/mac80211/offchannel.c-516-}\nnet/mac80211/offchannel.c:517:EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired);\nnet/mac80211/offchannel.c-518-\n--\nnet/mac80211/offchannel.c=559=static int ieee80211_start_roc_work(struct ieee80211_local local,\n--\nnet/mac80211/offchannel.c-702-\nnet/mac80211/offchannel.c:703:int ieee80211_remain_on_channel(struct wiphy wiphy, struct wireless_dev wdev,\nnet/mac80211/offchannel.c-704-\t\t\t\tstruct ieee80211_channel chan,\n" }
17/2	2026/08/01 19:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 35253 output: 27 thoughts: 39 Thoughts: Okay, here's my interpretation of those thoughts, framed as an expert's internal monologue: Checking the Stay-on-Channel Mechanism Alright, the core function in question here is clearly `ieee80211_remain_on_channel`. That's the one I need to focus on. My mental checklist kicks in automatically; the stay-on-channel mechanism is usually tightly coupled with management frame transmission. So, let me immediately cross-reference that with the relevant management frame transmission function. I'm going to quickly verify how `cfg80211_mlme_mgmt_tx` interacts with `ieee80211_remain_on_channel`. I need to ensure the proper interaction between these components. Is there a call directly from the former to the latter, or is it a more indirect interaction through other functions? Are there any data structures or flags shared to guarantee that stay-on-channel is respected when a management frame is transmitted? I need to understand the sequencing and the conditions under which the stay-on-channel process is initiated, handled, and finally, terminated in relation to frame transmission.
18/2	2026/08/01 19:23	tool	grepper	0m Args: { "Expression": "cfg80211_mlme_mgmt_tx" } Results: { "Output": "net/wireless/core.h=401=void cfg80211_mlme_purge_registrations(struct wireless_dev wdev);\nnet/wireless/core.h:402:int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device rdev,\nnet/wireless/core.h-403-\t\t\t struct wireless_dev wdev,\n--\nnet/wireless/mlme.c=862=static bool cfg80211_allowed_random_address(struct wireless_dev wdev,\n--\nnet/wireless/mlme.c-894-\nnet/wireless/mlme.c:895:int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device rdev,\nnet/wireless/mlme.c-896-\t\t\t struct wireless_dev wdev,\n--\nnet/wireless/nl80211.c=14764=static int nl80211_tx_mgmt(struct sk_buff skb, struct genl_info info)\n--\nnet/wireless/nl80211.c-14887-\tcookie = cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c:14888:\terr = cfg80211_mlme_mgmt_tx(rdev, wdev, \u0026params, cookie);\nnet/wireless/nl80211.c-14889-\tif (err)\n" }
19/2	2026/08/01 19:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 35962 output: 26 thoughts: 24 Thoughts: Okay, here's my summary, tailored for an expert audience, as if it's a direct stream of thought: Checking the Remain on Channel Functionality Yes, that's correct. I'm confirming that what I'm thinking is the case. Alright, now, the next logical step is to check the `nl80211_remain_on_channel` function itself. I need to get a clear picture of how this piece of code operates. Understanding its specifics is crucial for confirming my hypothesis. Let's see what's what.
20/2	2026/08/01 19:23	tool	grepper	0m Args: { "Expression": "nl80211_remain_on_channel" } Results: { "Output": "net/wireless/nl80211.c=14549=static int nl80211_tdls_oper(struct sk_buff skb, struct genl_info info)\n--\nnet/wireless/nl80211.c-14569-\nnet/wireless/nl80211.c:14570:static int nl80211_remain_on_channel(struct sk_buff skb,\nnet/wireless/nl80211.c-14571-\t\t\t\t struct genl_info info)\n--\nnet/wireless/nl80211.c=19733=static const struct genl_small_ops nl80211_small_ops[] = {\n--\nnet/wireless/nl80211.c-20089-\t\t.validate = GENL_DONT_VALIDATE_STRICT \| GENL_DONT_VALIDATE_DUMP,\nnet/wireless/nl80211.c:20090:\t\t.doit = nl80211_remain_on_channel,\nnet/wireless/nl80211.c-20091-\t\t.flags = GENL_UNS_ADMIN_PERM,\n" }
21/2	2026/08/01 19:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 36455 output: 24 thoughts: 22 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Confirming and Zeroing In Yes, that's exactly right, that's what I was thinking. Now, the next logical step is to dive right into the `nl80211_tx_mgmt` function. I need to refresh my understanding of how that module handles the transmission of management frames within the nl80211 framework. I have a feeling there might be a subtle nuance there that I've overlooked. Time to get down to brass tacks and double-check those parameters and the associated logic. I'm especially keen to see how it manages the frame construction and any potential rate control considerations. Let's see what's what.
22/2	2026/08/01 19:23	tool	grepper	0m Args: { "Expression": "nl80211_tx_mgmt" } Results: { "Output": "net/wireless/nl80211.c=14706=static int nl80211_register_mgmt(struct sk_buff skb, struct genl_info info)\n--\nnet/wireless/nl80211.c-14763-\nnet/wireless/nl80211.c:14764:static int nl80211_tx_mgmt(struct sk_buff skb, struct genl_info info)\nnet/wireless/nl80211.c-14765-{\n--\nnet/wireless/nl80211.c-14909-\nnet/wireless/nl80211.c:14910:static int nl80211_tx_mgmt_cancel_wait(struct sk_buff skb, struct genl_info info)\nnet/wireless/nl80211.c-14911-{\n--\nnet/wireless/nl80211.c=19733=static const struct genl_small_ops nl80211_small_ops[] = {\n--\nnet/wireless/nl80211.c-20120-\t\t.validate = GENL_DONT_VALIDATE_STRICT \| GENL_DONT_VALIDATE_DUMP,\nnet/wireless/nl80211.c:20121:\t\t.doit = nl80211_tx_mgmt,\nnet/wireless/nl80211.c-20122-\t\t.flags = GENL_UNS_ADMIN_PERM,\n--\nnet/wireless/nl80211.c-20127-\t\t.validate = GENL_DONT_VALIDATE_STRICT \| GENL_DONT_VALIDATE_DUMP,\nnet/wireless/nl80211.c:20128:\t\t.doit = nl80211_tx_mgmt_cancel_wait,\nnet/wireless/nl80211.c-20129-\t\t.flags = GENL_UNS_ADMIN_PERM,\n" }
23/2	2026/08/01 19:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 37195 output: 24 thoughts: 22 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Confirming and Zeroing In Yes, that's definitely the key point we're dealing with. Okay, so the next thing to investigate is `nl80211_probe_peer`. That's where I need to focus my attention. It's the logical next step in tracing this issue.
24/2	2026/08/01 19:23	tool	grepper	0m Args: { "Expression": "nl80211_probe_peer" } Results: { "Output": "net/wireless/nl80211.c=16310=static int nl80211_register_unexpected_frame(struct sk_buff skb,\n--\nnet/wireless/nl80211.c-16327-\nnet/wireless/nl80211.c:16328:static int nl80211_probe_peer(struct sk_buff skb, struct genl_info *info)\nnet/wireless/nl80211.c-16329-{\n--\nnet/wireless/nl80211.c=19733=static const struct genl_small_ops nl80211_small_ops[] = {\n--\nnet/wireless/nl80211.c-20237-\t\t.validate = GENL_DONT_VALIDATE_STRICT \| GENL_DONT_VALIDATE_DUMP,\nnet/wireless/nl80211.c:20238:\t\t.doit = nl80211_probe_peer,\nnet/wireless/nl80211.c-20239-\t\t.flags = GENL_UNS_ADMIN_PERM,\n" }
25/2	2026/08/01 19:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 37637 output: 26 thoughts: 24 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Analyzing the Transmission Control Port Yes, that's definitely the key area to be looking at. I'm focusing in on `nl80211_tx_control_port`. It's where the rubber meets the road, so to speak, in terms of actually controlling the transmission process for 802.11 frames. Gotta verify the nuances there.
26/2	2026/08/01 19:23	tool	grepper	0m Args: { "Expression": "nl80211_tx_control_port" } Results: { "Output": "net/wireless/nl80211.c=18494=static int nl80211_external_auth(struct sk_buff skb, struct genl_info info)\n--\nnet/wireless/nl80211.c-18535-\nnet/wireless/nl80211.c:18536:static int nl80211_tx_control_port(struct sk_buff skb, struct genl_info info)\nnet/wireless/nl80211.c-18537-{\n--\nnet/wireless/nl80211.c=19733=static const struct genl_small_ops nl80211_small_ops[] = {\n--\nnet/wireless/nl80211.c-20471-\t\t.validate = GENL_DONT_VALIDATE_STRICT \| GENL_DONT_VALIDATE_DUMP,\nnet/wireless/nl80211.c:20472:\t\t.doit = nl80211_tx_control_port,\nnet/wireless/nl80211.c-20473-\t\t.flags = GENL_UNS_ADMIN_PERM,\n" }
27/2	2026/08/01 19:23	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 38107 output: 331 thoughts: 438 Thoughts: Fuzzing Plan for This Patch Okay, yes, this patch looks solid, definitely functional, and ready for a good fuzzing run. My initial assessment is that it needs to be stressed with fuzzing. To ensure comprehensive coverage, I'll need to configure the fuzzing environment with `CFG80211`, `MAC80211`, and `MAC80211_HWSIM`. That will be my starting point. The core focus symbols for initial fuzzing are: - `nl80211_remain_on_channel` - `nl80211_tx_mgmt` - `nl80211_probe_peer` - `nl80211_tx_control_port` - `cfg80211_mlme_mgmt_tx` - `ieee80211_remain_on_channel` - `ieee80211_mgmt_tx` - `ieee80211_probe_peer` - `ieee80211_tx_control_port` However, a quick scan of the modified functions reveals several additional areas impacted. I see `ieee80211_attach_ack_skb` which looks interesting for fuzzing, as well as `ieee80211_start_roc_work`, which could also expose some vulnerabilities. I'm also seeing `ieee80211_mlo_multicast_tx_one`, `ieee80211_mlo_multicast_tx`, `ieee80211_subif_start_xmit`, `ieee80211_8023_xmit`, `ieee80211_build_data_template`, `ieee80211_probe_mesh_link`, and `ieee80211_tdls_prep_mgmt_packet`. Considering these, I'm going to add `ieee80211_attach_ack_skb` and `ieee80211_start_roc_work` to the initial focus list for fuzzing. This should give a robust test, and hopefully unearth any hidden bugs.
28/2	2026/08/01 19:24	tool	set-results	0m Args: { "EnableConfigs": [ "CFG80211", "MAC80211", "MAC80211_HWSIM" ], "FocusSymbols": [ "nl80211_remain_on_channel", "nl80211_tx_mgmt", "nl80211_probe_peer", "nl80211_tx_control_port", "cfg80211_mlme_mgmt_tx", "ieee80211_remain_on_channel", "ieee80211_mgmt_tx", "ieee80211_probe_peer", "ieee80211_tx_control_port", "ieee80211_attach_ack_skb", "ieee80211_start_roc_work" ], "Reasoning": "The patch changes how cookies are generated and passed for several nl80211 commands (remain_on_channel, tx_mgmt, probe_peer, tx_control_port). It modifies the core cfg80211 and mac80211 logic to generate cookies in nl80211 and pass them by value to drivers, instead of having drivers generate them and pass them back via pointers. This is a functional change to the core wireless stack and should be fuzzed.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "CFG80211", "MAC80211", "MAC80211_HWSIM" ], "FocusSymbols": [ "nl80211_remain_on_channel", "nl80211_tx_mgmt", "nl80211_probe_peer", "nl80211_tx_control_port", "cfg80211_mlme_mgmt_tx", "ieee80211_remain_on_channel", "ieee80211_mgmt_tx", "ieee80211_probe_peer", "ieee80211_tx_control_port", "ieee80211_attach_ack_skb", "ieee80211_start_roc_work" ], "Reasoning": "The patch changes how cookies are generated and passed for several nl80211 commands (remain_on_channel, tx_mgmt, probe_peer, tx_control_port). It modifies the core cfg80211 and mac80211 logic to generate cookies in nl80211 and pass them by value to drivers, instead of having drivers generate them and pass them back via pointers. This is a functional change to the core wireless stack and should be fuzzed.", "WorthFuzzing": true }

{
  "EnableConfigs": [
    "CFG80211",
    "MAC80211",
    "MAC80211_HWSIM"
  ],
  "FocusSymbols": [
    "nl80211_remain_on_channel",
    "nl80211_tx_mgmt",
    "nl80211_probe_peer",
    "nl80211_tx_control_port",
    "cfg80211_mlme_mgmt_tx",
    "ieee80211_remain_on_channel",
    "ieee80211_mgmt_tx",
    "ieee80211_probe_peer",
    "ieee80211_tx_control_port",
    "ieee80211_attach_ack_skb",
    "ieee80211_start_roc_work"
  ],
  "Reasoning": "The patch changes how cookies are generated and passed for several nl80211 commands (remain_on_channel, tx_mgmt, probe_peer, tx_control_port). It modifies the core cfg80211 and mac80211 logic to generate cookies in nl80211 and pass them by value to drivers, instead of having drivers generate them and pass them back via pointers. This is a functional change to the core wireless stack and should be fuzzed.",
  "WorthFuzzing": true
}

{
  "PatchDiff": "commit db647f403d99a4369043df3c05eea5ddf840805d\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sat Aug 1 19:22:36 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c\nindex ecde91159b546..34025d64d6158 100644\n--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c\n+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c\n@@ -3034,20 +3034,14 @@ static int ath6kl_remain_on_channel(struct wiphy *wiphy,\n \t\t\t\t    struct wireless_dev *wdev,\n \t\t\t\t    struct ieee80211_channel *chan,\n \t\t\t\t    unsigned int duration,\n-\t\t\t\t    u64 *cookie, const u8 *rx_addr)\n+\t\t\t\t    u64 cookie, const u8 *rx_addr)\n {\n \tstruct ath6kl_vif *vif = ath6kl_vif_from_wdev(wdev);\n \tstruct ath6kl *ar = ath6kl_priv(vif-\u003endev);\n-\tu32 id;\n \n \t/* TODO: if already pending or ongoing remain-on-channel,\n \t * return -EBUSY */\n-\tid = ++vif-\u003elast_roc_id;\n-\tif (id == 0) {\n-\t\t/* Do not use 0 as the cookie value */\n-\t\tid = ++vif-\u003elast_roc_id;\n-\t}\n-\t*cookie = id;\n+\tvif-\u003elast_roc_id = cookie;\n \n \treturn ath6kl_wmi_remain_on_chnl_cmd(ar-\u003ewmi, vif-\u003efw_vif_idx,\n \t\t\t\t\t     chan-\u003ecenter_freq, duration);\n@@ -3106,6 +3100,7 @@ static int ath6kl_send_go_probe_resp(struct ath6kl_vif *vif,\n \n static bool ath6kl_mgmt_powersave_ap(struct ath6kl_vif *vif,\n \t\t\t\t     u32 id,\n+\t\t\t\t     u64 cookie,\n \t\t\t\t     u32 freq,\n \t\t\t\t     u32 wait,\n \t\t\t\t     const u8 *buf,\n@@ -3138,6 +3133,7 @@ static bool ath6kl_mgmt_powersave_ap(struct ath6kl_vif *vif,\n \n \t\t\tINIT_LIST_HEAD(\u0026mgmt_buf-\u003elist);\n \t\t\tmgmt_buf-\u003eid = id;\n+\t\t\tmgmt_buf-\u003ecookie = cookie;\n \t\t\tmgmt_buf-\u003efreq = freq;\n \t\t\tmgmt_buf-\u003ewait = wait;\n \t\t\tmgmt_buf-\u003elen = len;\n@@ -3190,7 +3186,7 @@ static bool ath6kl_is_p2p_go_ssid(const u8 *buf, size_t len)\n }\n \n static int ath6kl_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n-\t\t\t  struct cfg80211_mgmt_tx_params *params, u64 *cookie)\n+\t\t\t  struct cfg80211_mgmt_tx_params *params, u64 cookie)\n {\n \tstruct ath6kl_vif *vif = ath6kl_vif_from_wdev(wdev);\n \tstruct ath6kl *ar = ath6kl_priv(vif-\u003endev);\n@@ -3222,7 +3218,6 @@ static int ath6kl_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t * Send Probe Response frame in GO mode using a separate WMI\n \t\t * command to allow the target to fill in the generic IEs.\n \t\t */\n-\t\t*cookie = 0; /* TX status not supported */\n \t\treturn ath6kl_send_go_probe_resp(vif, buf, len, freq);\n \t}\n \n@@ -3235,16 +3230,15 @@ static int ath6kl_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\tid = vif-\u003esend_action_id++;\n \t}\n \n-\t*cookie = id;\n-\n \t/* AP mode Power saving processing */\n \tif (vif-\u003enw_type == AP_NETWORK) {\n-\t\tqueued = ath6kl_mgmt_powersave_ap(vif, id, freq, wait, buf, len,\n-\t\t\t\t\t\t  \u0026more_data, no_cck);\n+\t\tqueued = ath6kl_mgmt_powersave_ap(vif, id, cookie, freq, wait,\n+\t\t\t\t\t\t  buf, len, \u0026more_data, no_cck);\n \t\tif (queued)\n \t\t\treturn 0;\n \t}\n \n+\tar-\u003ewmi-\u003elast_mgmt_tx_cookie = cookie;\n \treturn ath6kl_wmi_send_mgmt_cmd(ar-\u003ewmi, vif-\u003efw_vif_idx, id, freq,\n \t\t\t\t\twait, buf, len, no_cck);\n }\ndiff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h\nindex 77e052336eb5b..a0b236eeeab54 100644\n--- a/drivers/net/wireless/ath/ath6kl/core.h\n+++ b/drivers/net/wireless/ath/ath6kl/core.h\n@@ -404,6 +404,7 @@ struct ath6kl_mgmt_buff {\n \tu32 freq;\n \tu32 wait;\n \tu32 id;\n+\tu64 cookie;\n \tbool no_cck;\n \tsize_t len;\n \tu8 buf[];\n@@ -631,8 +632,8 @@ struct ath6kl_vif {\n \tstruct cfg80211_scan_request *scan_req;\n \tenum sme_state sme_state;\n \tint reconnect_flag;\n-\tu32 last_roc_id;\n-\tu32 last_cancel_roc_id;\n+\tu64 last_roc_id;\n+\tu64 last_cancel_roc_id;\n \tu32 send_action_id;\n \tbool probe_req_report;\n \tu16 assoc_bss_beacon_int;\ndiff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c\nindex 8afc6589fc51e..9c023d7ce3059 100644\n--- a/drivers/net/wireless/ath/ath6kl/main.c\n+++ b/drivers/net/wireless/ath/ath6kl/main.c\n@@ -898,6 +898,7 @@ void ath6kl_pspoll_event(struct ath6kl_vif *vif, u8 aid)\n \t\tspin_unlock_bh(\u0026conn-\u003epsq_lock);\n \n \t\tconn-\u003esta_flags |= STA_PS_POLLED;\n+\t\tar-\u003ewmi-\u003elast_mgmt_tx_cookie = mgmt_buf-\u003ecookie;\n \t\tath6kl_wmi_send_mgmt_cmd(ar-\u003ewmi, vif-\u003efw_vif_idx,\n \t\t\t\t\t mgmt_buf-\u003eid, mgmt_buf-\u003efreq,\n \t\t\t\t\t mgmt_buf-\u003ewait, mgmt_buf-\u003ebuf,\ndiff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c\nindex d818254139061..609d458ca6c57 100644\n--- a/drivers/net/wireless/ath/ath6kl/txrx.c\n+++ b/drivers/net/wireless/ath/ath6kl/txrx.c\n@@ -1469,6 +1469,7 @@ void ath6kl_rx(struct htc_target *target, struct htc_packet *packet)\n \t\t\t\t\tspin_unlock_bh(\u0026conn-\u003epsq_lock);\n \t\t\t\t\tidx = vif-\u003efw_vif_idx;\n \n+\t\t\t\t\tar-\u003ewmi-\u003elast_mgmt_tx_cookie = mgmt-\u003ecookie;\n \t\t\t\t\tath6kl_wmi_send_mgmt_cmd(ar-\u003ewmi,\n \t\t\t\t\t\t\t\t idx,\n \t\t\t\t\t\t\t\t mgmt-\u003eid,\ndiff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c\nindex 6c29f0bcec9f5..2140fddba8baf 100644\n--- a/drivers/net/wireless/ath/ath6kl/wmi.c\n+++ b/drivers/net/wireless/ath/ath6kl/wmi.c\n@@ -596,7 +596,7 @@ static int ath6kl_wmi_tx_status_event_rx(struct wmi *wmi, u8 *datap, int len,\n \tath6kl_dbg(ATH6KL_DBG_WMI, \"tx_status: id=%x ack_status=%u\\n\",\n \t\t   id, ev-\u003eack_status);\n \tif (wmi-\u003elast_mgmt_tx_frame) {\n-\t\tcfg80211_mgmt_tx_status(\u0026vif-\u003ewdev, id,\n+\t\tcfg80211_mgmt_tx_status(\u0026vif-\u003ewdev, wmi-\u003elast_mgmt_tx_cookie,\n \t\t\t\t\twmi-\u003elast_mgmt_tx_frame,\n \t\t\t\t\twmi-\u003elast_mgmt_tx_frame_len,\n \t\t\t\t\t!!ev-\u003eack_status, GFP_ATOMIC);\ndiff --git a/drivers/net/wireless/ath/ath6kl/wmi.h b/drivers/net/wireless/ath/ath6kl/wmi.h\nindex 8fbece3fdad9f..89ce2abbb1cdc 100644\n--- a/drivers/net/wireless/ath/ath6kl/wmi.h\n+++ b/drivers/net/wireless/ath/ath6kl/wmi.h\n@@ -125,6 +125,7 @@ struct wmi {\n \n \tu8 *last_mgmt_tx_frame;\n \tsize_t last_mgmt_tx_frame_len;\n+\tu64 last_mgmt_tx_cookie;\n \tu8 saved_pwr_mode;\n };\n \ndiff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c\nindex 5f2bd9a31faf6..9ac33d827f801 100644\n--- a/drivers/net/wireless/ath/wil6210/cfg80211.c\n+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c\n@@ -1432,7 +1432,7 @@ static int wil_cfg80211_set_wiphy_params(struct wiphy *wiphy, int radio_idx,\n \n int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t\t struct cfg80211_mgmt_tx_params *params,\n-\t\t\t u64 *cookie)\n+\t\t\t u64 cookie)\n {\n \tconst u8 *buf = params-\u003ebuf;\n \tsize_t len = params-\u003elen;\n@@ -1488,8 +1488,7 @@ int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t */\n \ttx_status = (rc == 0);\n \trc = (rc == -EAGAIN) ? 0 : rc;\n-\tcfg80211_mgmt_tx_status(wdev, cookie ? *cookie : 0, buf, len,\n-\t\t\t\ttx_status, GFP_KERNEL);\n+\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, tx_status, GFP_KERNEL);\n \n \treturn rc;\n }\n@@ -1735,7 +1734,7 @@ static int wil_remain_on_channel(struct wiphy *wiphy,\n \t\t\t\t struct wireless_dev *wdev,\n \t\t\t\t struct ieee80211_channel *chan,\n \t\t\t\t unsigned int duration,\n-\t\t\t\t u64 *cookie, const u8 *rx_addr)\n+\t\t\t\t u64 cookie, const u8 *rx_addr)\n {\n \tstruct wil6210_priv *wil = wiphy_to_wil(wiphy);\n \tint rc;\n@@ -2381,7 +2380,7 @@ void wil_probe_client_flush(struct wil6210_vif *vif)\n \n static int wil_cfg80211_probe_peer(struct wiphy *wiphy,\n \t\t\t\t   struct net_device *dev,\n-\t\t\t\t   const u8 *peer, u64 *cookie)\n+\t\t\t\t   const u8 *peer, u64 cookie)\n {\n \tstruct wil6210_priv *wil = wiphy_to_wil(wiphy);\n \tstruct wil6210_vif *vif = ndev_to_vif(dev);\n@@ -2399,13 +2398,12 @@ static int wil_cfg80211_probe_peer(struct wiphy *wiphy,\n \t\treturn -ENOMEM;\n \n \treq-\u003ecid = cid;\n-\treq-\u003ecookie = cid;\n+\treq-\u003ecookie = cookie;\n \n \tmutex_lock(\u0026vif-\u003eprobe_client_mutex);\n \tlist_add_tail(\u0026req-\u003elist, \u0026vif-\u003eprobe_client_pending);\n \tmutex_unlock(\u0026vif-\u003eprobe_client_mutex);\n \n-\t*cookie = req-\u003ecookie;\n \tqueue_work(wil-\u003ewq_service, \u0026vif-\u003eprobe_client_worker);\n \treturn 0;\n }\ndiff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c\nindex b8cb736a71852..e06e45323272c 100644\n--- a/drivers/net/wireless/ath/wil6210/debugfs.c\n+++ b/drivers/net/wireless/ath/wil6210/debugfs.c\n@@ -985,7 +985,7 @@ static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf,\n \tparams.buf = frame;\n \tparams.len = len;\n \n-\trc = wil_cfg80211_mgmt_tx(wiphy, wdev, \u0026params, NULL);\n+\trc = wil_cfg80211_mgmt_tx(wiphy, wdev, \u0026params, 0);\n \n \tkfree(frame);\n \twil_info(wil, \"-\u003e %d\\n\", rc);\ndiff --git a/drivers/net/wireless/ath/wil6210/p2p.c b/drivers/net/wireless/ath/wil6210/p2p.c\nindex f20caf1a3905b..acd8a2e351032 100644\n--- a/drivers/net/wireless/ath/wil6210/p2p.c\n+++ b/drivers/net/wireless/ath/wil6210/p2p.c\n@@ -124,7 +124,7 @@ int wil_p2p_search(struct wil6210_vif *vif,\n \n int wil_p2p_listen(struct wil6210_priv *wil, struct wireless_dev *wdev,\n \t\t   unsigned int duration, struct ieee80211_channel *chan,\n-\t\t   u64 *cookie)\n+\t\t   u64 cookie)\n {\n \tstruct wil6210_vif *vif = wdev_to_vif(wil, wdev);\n \tstruct wil_p2p_info *p2p = \u0026vif-\u003ep2p;\n@@ -144,7 +144,7 @@ int wil_p2p_listen(struct wil6210_priv *wil, struct wireless_dev *wdev,\n \t}\n \n \tmemcpy(\u0026p2p-\u003elisten_chan, chan, sizeof(*chan));\n-\t*cookie = ++p2p-\u003ecookie;\n+\tp2p-\u003ecookie = cookie;\n \tp2p-\u003elisten_duration = duration;\n \n \tmutex_lock(\u0026wil-\u003evif_mutex);\n@@ -166,7 +166,7 @@ int wil_p2p_listen(struct wil6210_priv *wil, struct wireless_dev *wdev,\n \tif (vif-\u003emid == 0)\n \t\twil-\u003eradio_wdev = wdev;\n \n-\tcfg80211_ready_on_channel(wdev, *cookie, chan, duration,\n+\tcfg80211_ready_on_channel(wdev, cookie, chan, duration,\n \t\t\t\t  GFP_KERNEL);\n \n out:\ndiff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h\nindex 31e107c81e2d4..f8e60be631ca5 100644\n--- a/drivers/net/wireless/ath/wil6210/wil6210.h\n+++ b/drivers/net/wireless/ath/wil6210/wil6210.h\n@@ -1301,7 +1301,7 @@ int wil_p2p_search(struct wil6210_vif *vif,\n \t\t   struct cfg80211_scan_request *request);\n int wil_p2p_listen(struct wil6210_priv *wil, struct wireless_dev *wdev,\n \t\t   unsigned int duration, struct ieee80211_channel *chan,\n-\t\t   u64 *cookie);\n+\t\t   u64 cookie);\n u8 wil_p2p_stop_discovery(struct wil6210_vif *vif);\n int wil_p2p_cancel_listen(struct wil6210_vif *vif, u64 cookie);\n void wil_p2p_listen_expired(struct work_struct *work);\n@@ -1317,7 +1317,7 @@ int wmi_stop_discovery(struct wil6210_vif *vif);\n \n int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t\t struct cfg80211_mgmt_tx_params *params,\n-\t\t\t u64 *cookie);\n+\t\t\t u64 cookie);\n void wil_cfg80211_ap_recovery(struct wil6210_priv *wil);\n int wil_cfg80211_iface_combinations_from_fw(\n \tstruct wil6210_priv *wil,\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\nindex 6b2c34e3a796c..872c48806d091 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\n@@ -5554,7 +5554,7 @@ brcmf_cfg80211_update_mgmt_frame_registrations(struct wiphy *wiphy,\n \n int\n brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n-\t\t       struct cfg80211_mgmt_tx_params *params, u64 *cookie)\n+\t\t       struct cfg80211_mgmt_tx_params *params, u64 cookie)\n {\n \tstruct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);\n \tstruct ieee80211_channel *chan = params-\u003echan;\n@@ -5573,8 +5573,6 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \n \tbrcmf_dbg(TRACE, \"Enter\\n\");\n \n-\t*cookie = 0;\n-\n \tmgmt = (const struct ieee80211_mgmt *)buf;\n \n \tif (!ieee80211_is_mgmt(mgmt-\u003eframe_control)) {\n@@ -5605,7 +5603,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t\t\t\t    BRCMF_VNDR_IE_PRBRSP_FLAG,\n \t\t\t\t\t    \u0026buf[ie_offset],\n \t\t\t\t\t    ie_len);\n-\t\tcfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,\n+\t\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, true,\n \t\t\t\t\tGFP_KERNEL);\n \t} else if (ieee80211_is_action(mgmt-\u003eframe_control)) {\n \t\tif (len \u003e BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {\n@@ -5621,7 +5619,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t}\n \t\taction_frame = \u0026af_params-\u003eaction_frame;\n \t\t/* Add the packet Id */\n-\t\taction_frame-\u003epacket_id = cpu_to_le32(*cookie);\n+\t\taction_frame-\u003epacket_id = cpu_to_le32(cookie);\n \t\t/* Add BSSID */\n \t\tmemcpy(\u0026action_frame-\u003eda[0], \u0026mgmt-\u003eda[0], ETH_ALEN);\n \t\tmemcpy(\u0026af_params-\u003ebssid[0], \u0026mgmt-\u003ebssid[0], ETH_ALEN);\n@@ -5649,12 +5647,12 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t       le16_to_cpu(action_frame-\u003elen));\n \n \t\tbrcmf_dbg(TRACE, \"Action frame, cookie=%lld, len=%d, channel=%d\\n\",\n-\t\t\t  *cookie, le16_to_cpu(action_frame-\u003elen),\n+\t\t\t  cookie, le16_to_cpu(action_frame-\u003elen),\n \t\t\t  le32_to_cpu(af_params-\u003echannel));\n \n \t\tack = brcmf_p2p_send_action_frame(vif-\u003eifp, af_params);\n \n-\t\tcfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,\n+\t\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, ack,\n \t\t\t\t\tGFP_KERNEL);\n free:\n \t\tkfree(af_params);\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h\nindex 6ceb301429054..63e534523f518 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h\n@@ -497,6 +497,6 @@ void brcmf_cfg80211_free_vif(struct net_device *ndev);\n \n int brcmf_set_wsec(struct brcmf_if *ifp, const u8 *key, u16 key_len, u16 flags);\n int brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n-\t\t\t   struct cfg80211_mgmt_tx_params *params, u64 *cookie);\n+\t\t\t   struct cfg80211_mgmt_tx_params *params, u64 cookie);\n \n #endif /* BRCMFMAC_CFG80211_H */\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c\nindex 873754be5174b..545eb9aae9660 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c\n@@ -100,7 +100,7 @@ static int brcmf_cyw_activate_events(struct brcmf_if *ifp)\n \n static\n int brcmf_cyw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n-\t\t      struct cfg80211_mgmt_tx_params *params, u64 *cookie)\n+\t\t      struct cfg80211_mgmt_tx_params *params, u64 cookie)\n {\n \tstruct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);\n \tstruct ieee80211_channel *chan = params-\u003echan;\n@@ -123,7 +123,6 @@ int brcmf_cyw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \tif (!ieee80211_is_auth(mgmt-\u003eframe_control))\n \t\treturn brcmf_cfg80211_mgmt_tx(wiphy, wdev, params, cookie);\n \n-\t*cookie = 0;\n \tvif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);\n \n \treinit_completion(\u0026vif-\u003emgmt_tx);\n@@ -155,7 +154,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \n \tmemcpy(\u0026mf_params-\u003eda[0], \u0026mgmt-\u003eda[0], ETH_ALEN);\n \tmemcpy(\u0026mf_params-\u003ebssid[0], \u0026mgmt-\u003ebssid[0], ETH_ALEN);\n-\tmf_params-\u003epacket_id = cpu_to_le32(*cookie);\n+\tmf_params-\u003epacket_id = cpu_to_le32(cookie);\n \tmemcpy(mf_params-\u003edata, \u0026buf[DOT11_MGMT_HDR_LEN],\n \t       le16_to_cpu(mf_params-\u003elen));\n \n@@ -187,8 +186,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t}\n \n tx_status:\n-\tcfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,\n-\t\t\t\tGFP_KERNEL);\n+\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, ack, GFP_KERNEL);\n free:\n \tkfree(mf_params);\n \treturn err;\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c\nindex c7d7b35ab1253..32a015d6b7698 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c\n@@ -979,10 +979,8 @@ brcmf_p2p_discover_listen(struct brcmf_p2p_info *p2p, u16 channel, u32 duration)\n \tp2p-\u003ecfg-\u003ed11inf.encchspec(\u0026ch);\n \terr = brcmf_p2p_set_discover_state(vif-\u003eifp, WL_P2P_DISC_ST_LISTEN,\n \t\t\t\t\t   ch.chspec, (u16)duration);\n-\tif (!err) {\n+\tif (!err)\n \t\tset_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, \u0026p2p-\u003estatus);\n-\t\tp2p-\u003eremain_on_channel_cookie++;\n-\t}\n exit:\n \treturn err;\n }\n@@ -1000,7 +998,7 @@ brcmf_p2p_discover_listen(struct brcmf_p2p_info *p2p, u16 channel, u32 duration)\n  */\n int brcmf_p2p_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t\t\tstruct ieee80211_channel *channel,\n-\t\t\t\tunsigned int duration, u64 *cookie,\n+\t\t\t\tunsigned int duration, u64 cookie,\n \t\t\t\tconst u8 *rx_addr)\n {\n \tstruct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);\n@@ -1020,8 +1018,8 @@ int brcmf_p2p_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\tgoto exit;\n \n \tmemcpy(\u0026p2p-\u003eremain_on_channel, channel, sizeof(*channel));\n-\t*cookie = p2p-\u003eremain_on_channel_cookie;\n-\tcfg80211_ready_on_channel(wdev, *cookie, channel, duration, GFP_KERNEL);\n+\tp2p-\u003eremain_on_channel_cookie = cookie;\n+\tcfg80211_ready_on_channel(wdev, cookie, channel, duration, GFP_KERNEL);\n \n exit:\n \treturn err;\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h\nindex 9f3f01ade2b77..7078009491707 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h\n@@ -157,7 +157,7 @@ int brcmf_p2p_scan_prep(struct wiphy *wiphy,\n \t\t\tstruct brcmf_cfg80211_vif *vif);\n int brcmf_p2p_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t\t\tstruct ieee80211_channel *channel,\n-\t\t\t\tunsigned int duration, u64 *cookie,\n+\t\t\t\tunsigned int duration, u64 cookie,\n \t\t\t\tconst u8 *rx_addr);\n int brcmf_p2p_notify_listen_complete(struct brcmf_if *ifp,\n \t\t\t\t     const struct brcmf_event_msg *e,\ndiff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c\nindex 8ec2d22a8c33a..7a1ba32f1fb36 100644\n--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c\n+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c\n@@ -196,7 +196,7 @@ mwifiex_form_mgmt_frame(struct sk_buff *skb, const u8 *buf, size_t len)\n  */\n static int\n mwifiex_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n-\t\t\t struct cfg80211_mgmt_tx_params *params, u64 *cookie)\n+\t\t\t struct cfg80211_mgmt_tx_params *params, u64 cookie)\n {\n \tconst u8 *buf = params-\u003ebuf;\n \tsize_t len = params-\u003elen;\n@@ -259,14 +259,13 @@ mwifiex_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \ttx_info-\u003epkt_len = pkt_len;\n \n \tmwifiex_form_mgmt_frame(skb, buf, len);\n-\t*cookie = get_random_u32() | 1;\n \n \tif (ieee80211_is_action(mgmt-\u003eframe_control))\n \t\tskb = mwifiex_clone_skb_for_tx_status(priv,\n \t\t\t\t\t\t      skb,\n-\t\t\t\tMWIFIEX_BUF_FLAG_ACTION_TX_STATUS, cookie);\n+\t\t\t\tMWIFIEX_BUF_FLAG_ACTION_TX_STATUS, \u0026cookie);\n \telse\n-\t\tcfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,\n+\t\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, true,\n \t\t\t\t\tGFP_ATOMIC);\n \n \tmwifiex_queue_tx_pkt(priv, skb);\n@@ -304,13 +303,13 @@ static int\n mwifiex_cfg80211_remain_on_channel(struct wiphy *wiphy,\n \t\t\t\t   struct wireless_dev *wdev,\n \t\t\t\t   struct ieee80211_channel *chan,\n-\t\t\t\t   unsigned int duration, u64 *cookie,\n+\t\t\t\t   unsigned int duration, u64 cookie,\n \t\t\t\t   const u8 *rx_addr)\n {\n \tstruct mwifiex_private *priv = mwifiex_netdev_get_priv(wdev-\u003enetdev);\n \tint ret;\n \n-\tif (!chan || !cookie) {\n+\tif (!chan) {\n \t\tmwifiex_dbg(priv-\u003eadapter, ERROR, \"Invalid parameter for ROC\\n\");\n \t\treturn -EINVAL;\n \t}\n@@ -326,15 +325,14 @@ mwifiex_cfg80211_remain_on_channel(struct wiphy *wiphy,\n \t\t\t\t\t duration);\n \n \tif (!ret) {\n-\t\t*cookie = get_random_u32() | 1;\n-\t\tpriv-\u003eroc_cfg.cookie = *cookie;\n+\t\tpriv-\u003eroc_cfg.cookie = cookie;\n \t\tpriv-\u003eroc_cfg.chan = *chan;\n \n-\t\tcfg80211_ready_on_channel(wdev, *cookie, chan,\n+\t\tcfg80211_ready_on_channel(wdev, cookie, chan,\n \t\t\t\t\t  duration, GFP_ATOMIC);\n \n \t\tmwifiex_dbg(priv-\u003eadapter, INFO,\n-\t\t\t    \"info: ROC, cookie = 0x%llx\\n\", *cookie);\n+\t\t\t    \"info: ROC, cookie = 0x%llx\\n\", cookie);\n \t}\n \n \treturn ret;\n@@ -4560,7 +4558,7 @@ mwifiex_cfg80211_disassociate(struct wiphy *wiphy,\n static int\n mwifiex_cfg80211_probe_peer(struct wiphy *wiphy,\n \t\t\t    struct net_device *dev, const u8 *peer,\n-\t\t\t    u64 *cookie)\n+\t\t\t    u64 cookie)\n {\n \t/* hostapd looks for NL80211_CMD_PROBE_CLIENT support; otherwise,\n \t * it requires monitor-mode support (which mwifiex doesn't support).\ndiff --git a/drivers/net/wireless/microchip/wilc1000/cfg80211.c b/drivers/net/wireless/microchip/wilc1000/cfg80211.c\nindex 6654fce4ded84..bb2748a193294 100644\n--- a/drivers/net/wireless/microchip/wilc1000/cfg80211.c\n+++ b/drivers/net/wireless/microchip/wilc1000/cfg80211.c\n@@ -1100,24 +1100,19 @@ static void wilc_wfi_remain_on_channel_expired(struct wilc_vif *vif, u64 cookie)\n static int remain_on_channel(struct wiphy *wiphy,\n \t\t\t     struct wireless_dev *wdev,\n \t\t\t     struct ieee80211_channel *chan,\n-\t\t\t     unsigned int duration, u64 *cookie,\n+\t\t\t     unsigned int duration, u64 cookie,\n \t\t\t     const u8 *rx_addr)\n {\n \tint ret = 0;\n \tstruct wilc_vif *vif = netdev_priv(wdev-\u003enetdev);\n \tstruct wilc_priv *priv = \u0026vif-\u003epriv;\n-\tu64 id;\n \n \tif (wdev-\u003eiftype == NL80211_IFTYPE_AP) {\n \t\tnetdev_dbg(vif-\u003endev, \"Required while in AP mode\\n\");\n \t\treturn ret;\n \t}\n \n-\tid = ++priv-\u003einc_roc_cookie;\n-\tif (id == 0)\n-\t\tid = ++priv-\u003einc_roc_cookie;\n-\n-\tret = wilc_remain_on_channel(vif, id, chan-\u003ehw_value,\n+\tret = wilc_remain_on_channel(vif, cookie, chan-\u003ehw_value,\n \t\t\t\t     wilc_wfi_remain_on_channel_expired);\n \tif (ret)\n \t\treturn ret;\n@@ -1125,12 +1120,11 @@ static int remain_on_channel(struct wiphy *wiphy,\n \tvif-\u003ewilc-\u003eop_ch = chan-\u003ehw_value;\n \n \tpriv-\u003eremain_on_ch_params.listen_ch = chan;\n-\tpriv-\u003eremain_on_ch_params.listen_cookie = id;\n-\t*cookie = id;\n+\tpriv-\u003eremain_on_ch_params.listen_cookie = cookie;\n \tpriv-\u003ep2p_listen_state = true;\n \tpriv-\u003eremain_on_ch_params.listen_duration = duration;\n \n-\tcfg80211_ready_on_channel(wdev, *cookie, chan, duration, GFP_KERNEL);\n+\tcfg80211_ready_on_channel(wdev, cookie, chan, duration, GFP_KERNEL);\n \tmod_timer(\u0026vif-\u003ehif_drv-\u003eremain_on_ch_timer,\n \t\t  jiffies + msecs_to_jiffies(duration + 1000));\n \n@@ -1153,7 +1147,7 @@ static int cancel_remain_on_channel(struct wiphy *wiphy,\n static int mgmt_tx(struct wiphy *wiphy,\n \t\t   struct wireless_dev *wdev,\n \t\t   struct cfg80211_mgmt_tx_params *params,\n-\t\t   u64 *cookie)\n+\t\t   u64 cookie)\n {\n \tstruct ieee80211_channel *chan = params-\u003echan;\n \tunsigned int wait = params-\u003ewait;\n@@ -1170,8 +1164,7 @@ static int mgmt_tx(struct wiphy *wiphy,\n \tconst u8 *vendor_ie;\n \tint ret = 0;\n \n-\t*cookie = get_random_u32();\n-\tpriv-\u003etx_cookie = *cookie;\n+\tpriv-\u003etx_cookie = cookie;\n \tmgmt = (const struct ieee80211_mgmt *)buf;\n \n \tif (!ieee80211_is_mgmt(mgmt-\u003eframe_control))\ndiff --git a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c\nindex 4f9e20f728114..c820f08d28355 100644\n--- a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c\n+++ b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c\n@@ -150,7 +150,7 @@ nxpwifi_form_mgmt_frame(struct sk_buff *skb, const u8 *buf, size_t len)\n /* cfg80211 operation handler to transmit a management frame. */\n static int\n nxpwifi_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n-\t\t\t struct cfg80211_mgmt_tx_params *params, u64 *cookie)\n+\t\t\t struct cfg80211_mgmt_tx_params *params, u64 cookie)\n {\n \tconst u8 *buf = params-\u003ebuf;\n \tsize_t len = params-\u003elen;\n@@ -212,14 +212,13 @@ nxpwifi_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \ttx_info-\u003epkt_len = pkt_len;\n \n \tnxpwifi_form_mgmt_frame(skb, buf, len);\n-\t*cookie = nxpwifi_roc_cookie(priv-\u003eadapter);\n \n \tif (ieee80211_is_action(mgmt-\u003eframe_control))\n \t\tskb = nxpwifi_clone_skb_for_tx_status(priv,\n \t\t\t\t\t\t      skb,\n-\t\t\t\tNXPWIFI_BUF_FLAG_ACTION_TX_STATUS, cookie);\n+\t\t\t\tNXPWIFI_BUF_FLAG_ACTION_TX_STATUS, \u0026cookie);\n \telse\n-\t\tcfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,\n+\t\tcfg80211_mgmt_tx_status(wdev, cookie, buf, len, true,\n \t\t\t\t\tGFP_ATOMIC);\n \n \tnxpwifi_queue_tx_pkt(priv, skb);\n@@ -254,14 +253,14 @@ static int\n nxpwifi_cfg80211_remain_on_channel(struct wiphy *wiphy,\n \t\t\t\t   struct wireless_dev *wdev,\n \t\t\t\t   struct ieee80211_channel *chan,\n-\t\t\t\t   unsigned int duration, u64 *cookie,\n+\t\t\t\t   unsigned int duration, u64 cookie,\n \t\t\t\t   const u8 *rx_addr)\n {\n \tstruct nxpwifi_private *priv = nxpwifi_netdev_get_priv(wdev-\u003enetdev);\n \tstruct nxpwifi_adapter *adapter = priv-\u003eadapter;\n \tint ret;\n \n-\tif (!chan || !cookie) {\n+\tif (!chan) {\n \t\tnxpwifi_dbg(adapter, ERROR, \"Invalid parameter for ROC\\n\");\n \t\treturn -EINVAL;\n \t}\n@@ -277,15 +276,14 @@ nxpwifi_cfg80211_remain_on_channel(struct wiphy *wiphy,\n \t\t\t\t\t duration);\n \n \tif (!ret) {\n-\t\t*cookie = nxpwifi_roc_cookie(adapter);\n-\t\tpriv-\u003eroc_cfg.cookie = *cookie;\n+\t\tpriv-\u003eroc_cfg.cookie = cookie;\n \t\tpriv-\u003eroc_cfg.chan = *chan;\n \n-\t\tcfg80211_ready_on_channel(wdev, *cookie, chan,\n+\t\tcfg80211_ready_on_channel(wdev, cookie, chan,\n \t\t\t\t\t  duration, GFP_ATOMIC);\n \n \t\tnxpwifi_dbg(adapter, INFO,\n-\t\t\t    \"info: ROC, cookie = 0x%llx\\n\", *cookie);\n+\t\t\t    \"info: ROC, cookie = 0x%llx\\n\", cookie);\n \t}\n \n \treturn ret;\n@@ -3618,7 +3616,7 @@ nxpwifi_cfg80211_disassociate(struct wiphy *wiphy,\n static int\n nxpwifi_cfg80211_probe_peer(struct wiphy *wiphy,\n \t\t\t      struct net_device *dev, const u8 *peer,\n-\t\t\t      u64 *cookie)\n+\t\t\t      u64 cookie)\n {\n \t/*\n \t * hostapd looks for NL80211_CMD_PROBE_CLIENT support; otherwise,\ndiff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c\nindex 9e44c85d2051c..45e2b7ae96333 100644\n--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c\n+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c\n@@ -446,7 +446,7 @@ qtnf_update_mgmt_frame_registrations(struct wiphy *wiphy,\n \n static int\n qtnf_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n-\t     struct cfg80211_mgmt_tx_params *params, u64 *cookie)\n+\t     struct cfg80211_mgmt_tx_params *params, u64 cookie)\n {\n \tstruct qtnf_vif *vif = qtnf_netdev_get_priv(wdev-\u003enetdev);\n \tconst struct ieee80211_mgmt *mgmt_frame = (void *)params-\u003ebuf;\n@@ -454,8 +454,6 @@ qtnf_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \tu16 flags = 0;\n \tu16 freq;\n \n-\t*cookie = short_cookie;\n-\n \tif (params-\u003eoffchan)\n \t\tflags |= QLINK_FRAME_TX_FLAG_OFFCHAN;\n \ndiff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c\nindex 6a97afd89dc78..b58dda129ff66 100644\n--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c\n+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c\n@@ -2530,7 +2530,7 @@ static int _cfg80211_rtw_mgmt_tx(struct adapter *padapter, u8 tx_ch, const u8 *b\n \n static int cfg80211_rtw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t\t\tstruct cfg80211_mgmt_tx_params *params,\n-\t\t\t\tu64 *cookie)\n+\t\t\t\tu64 cookie)\n {\n \tstruct net_device *ndev = wdev_to_ndev(wdev);\n \tstruct ieee80211_channel *chan = params-\u003echan;\n@@ -2552,11 +2552,8 @@ static int cfg80211_rtw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \n \tpadapter = rtw_netdev_priv(ndev);\n \n-\t/* cookie generation */\n-\t*cookie = (unsigned long)buf;\n-\n \t/* indicate ack before issue frame to avoid racing with rsp frame */\n-\trtw_cfg80211_mgmt_tx_status(padapter, *cookie, buf, len, ack, GFP_KERNEL);\n+\trtw_cfg80211_mgmt_tx_status(padapter, cookie, buf, len, ack, GFP_KERNEL);\n \n \tif (!rtw_action_frame_parse(buf, len, \u0026category, \u0026action))\n \t\tgoto exit;\ndiff --git a/include/net/cfg80211.h b/include/net/cfg80211.h\nindex dcbb0e55c32ec..97c16d4ff1271 100644\n--- a/include/net/cfg80211.h\n+++ b/include/net/cfg80211.h\n@@ -5108,7 +5108,8 @@ struct mgmt_frame_regs {\n  * @tdls_oper: Perform a high-level TDLS operation (e.g. TDLS link setup).\n  *\n  * @probe_peer: probe a connected peer (AP: STA MAC required; STA: no MAC),\n- *\tmust return a cookie that is later passed to cfg80211_probe_status().\n+ *\tmust use the @cookie as provided which is later passed to\n+ *\tcfg80211_probe_status().\n  *\n  * @set_noack_map: Set the NoAck Map for the TIDs.\n  *\n@@ -5219,7 +5220,8 @@ struct mgmt_frame_regs {\n  *     user space\n  *\n  * @tx_control_port: TX a control port frame (EAPoL).  The noencrypt parameter\n- *\ttells the driver that the frame should not be encrypted.\n+ *\ttells the driver that the frame should not be encrypted. A @cookie\n+ *\tvalue of 0 means the caller does not want TX status reporting.\n  *\n  * @get_ftm_responder_stats: Retrieve FTM responder statistics, if available.\n  *\tStatistics should be cumulative, currently no way to reset is provided.\n@@ -5456,14 +5458,14 @@ struct cfg80211_ops {\n \t\t\t\t     struct wireless_dev *wdev,\n \t\t\t\t     struct ieee80211_channel *chan,\n \t\t\t\t     unsigned int duration,\n-\t\t\t\t     u64 *cookie, const u8 *rx_addr);\n+\t\t\t\t     u64 cookie, const u8 *rx_addr);\n \tint\t(*cancel_remain_on_channel)(struct wiphy *wiphy,\n \t\t\t\t\t    struct wireless_dev *wdev,\n \t\t\t\t\t    u64 cookie);\n \n \tint\t(*mgmt_tx)(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t\t   struct cfg80211_mgmt_tx_params *params,\n-\t\t\t   u64 *cookie);\n+\t\t\t   u64 cookie);\n \tint\t(*mgmt_tx_cancel_wait)(struct wiphy *wiphy,\n \t\t\t\t       struct wireless_dev *wdev,\n \t\t\t\t       u64 cookie);\n@@ -5510,7 +5512,7 @@ struct cfg80211_ops {\n \t\t\t     const u8 *peer, enum nl80211_tdls_operation oper);\n \n \tint\t(*probe_peer)(struct wiphy *wiphy, struct net_device *dev,\n-\t\t\t      const u8 *peer, u64 *cookie);\n+\t\t\t      const u8 *peer, u64 cookie);\n \n \tint\t(*set_noack_map)(struct wiphy *wiphy,\n \t\t\t\t  struct net_device *dev,\n@@ -5608,7 +5610,7 @@ struct cfg80211_ops {\n \t\t\t\t   const u8 *buf, size_t len,\n \t\t\t\t   const u8 *dest, const __be16 proto,\n \t\t\t\t   const bool noencrypt, int link_id,\n-\t\t\t\t   u64 *cookie);\n+\t\t\t\t   u64 cookie);\n \n \tint\t(*get_ftm_responder_stats)(struct wiphy *wiphy,\n \t\t\t\tstruct net_device *dev,\ndiff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c\nindex 0a9247be26afa..0c2c7afd59c4a 100644\n--- a/net/mac80211/cfg.c\n+++ b/net/mac80211/cfg.c\n@@ -4831,19 +4831,6 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,\n \treturn __ieee80211_channel_switch(wiphy, dev, params);\n }\n \n-u64 ieee80211_mgmt_tx_cookie(struct ieee80211_local *local)\n-{\n-\tlockdep_assert_wiphy(local-\u003ehw.wiphy);\n-\n-\tlocal-\u003eroc_cookie_counter++;\n-\n-\t/* wow, you wrapped 64 bits ... more likely a bug */\n-\tif (WARN_ON(local-\u003eroc_cookie_counter == 0))\n-\t\tlocal-\u003eroc_cookie_counter++;\n-\n-\treturn local-\u003eroc_cookie_counter;\n-}\n-\n int ieee80211_attach_ack_skb(struct ieee80211_local *local, struct sk_buff *skb,\n \t\t\t     u64 *cookie, gfp_t gfp)\n {\n@@ -4868,7 +4855,6 @@ int ieee80211_attach_ack_skb(struct ieee80211_local *local, struct sk_buff *skb,\n \tIEEE80211_SKB_CB(skb)-\u003estatus_data_idr = 1;\n \tIEEE80211_SKB_CB(skb)-\u003estatus_data = id;\n \n-\t*cookie = ieee80211_mgmt_tx_cookie(local);\n \tIEEE80211_SKB_CB(ack_skb)-\u003eack.cookie = *cookie;\n \n \treturn 0;\n@@ -4954,7 +4940,7 @@ static int ieee80211_set_rekey_data(struct wiphy *wiphy,\n }\n \n static int ieee80211_probe_peer(struct wiphy *wiphy, struct net_device *dev,\n-\t\t\t\tconst u8 *peer, u64 *cookie)\n+\t\t\t\tconst u8 *peer, u64 cookie)\n {\n \tstruct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);\n \tstruct ieee80211_local *local = sdata-\u003elocal;\n@@ -5061,7 +5047,7 @@ static int ieee80211_probe_peer(struct wiphy *wiphy, struct net_device *dev,\n \tif (qos)\n \t\tnullfunc-\u003eqos_ctrl = cpu_to_le16(7);\n \n-\tret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_ATOMIC);\n+\tret = ieee80211_attach_ack_skb(local, skb, \u0026cookie, GFP_ATOMIC);\n \tif (ret) {\n \t\tkfree_skb(skb);\n \t\treturn ret;\ndiff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h\nindex a1ef88fe846dd..5761e96214914 100644\n--- a/net/mac80211/ieee80211_i.h\n+++ b/net/mac80211/ieee80211_i.h\n@@ -1710,8 +1710,6 @@ struct ieee80211_local {\n \tstruct list_head roc_list;\n \tstruct wiphy_work hw_roc_start, hw_roc_done;\n \tunsigned long hw_roc_start_time;\n-\tu64 roc_cookie_counter;\n-\n \tstruct idr ack_status_frames;\n \tspinlock_t ack_status_lock;\n \n@@ -1991,7 +1989,6 @@ u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);\n \n void ieee80211_handle_queued_frames(struct ieee80211_local *local);\n \n-u64 ieee80211_mgmt_tx_cookie(struct ieee80211_local *local);\n int ieee80211_attach_ack_skb(struct ieee80211_local *local, struct sk_buff *skb,\n \t\t\t     u64 *cookie, gfp_t gfp);\n \n@@ -2153,12 +2150,12 @@ void ieee80211_roc_purge(struct ieee80211_local *local,\n \t\t\t struct ieee80211_sub_if_data *sdata);\n int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t\t\tstruct ieee80211_channel *chan,\n-\t\t\t\tunsigned int duration, u64 *cookie,\n+\t\t\t\tunsigned int duration, u64 cookie,\n \t\t\t\tconst u8 *rx_addr);\n int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,\n \t\t\t\t       struct wireless_dev *wdev, u64 cookie);\n int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n-\t\t      struct cfg80211_mgmt_tx_params *params, u64 *cookie);\n+\t\t      struct cfg80211_mgmt_tx_params *params, u64 cookie);\n int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,\n \t\t\t\t  struct wireless_dev *wdev, u64 cookie);\n \n@@ -2237,7 +2234,7 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,\n \t\t\t\t  struct net_device *dev,\n \t\t\t\t  u32 info_flags,\n \t\t\t\t  u32 ctrl_flags,\n-\t\t\t\t  u64 *cookie);\n+\t\t\t\t  u64 cookie);\n struct sk_buff *\n ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,\n \t\t\t      struct sk_buff *skb, u32 info_flags);\n@@ -2251,7 +2248,7 @@ void ieee80211_clear_fast_xmit(struct sta_info *sta);\n int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,\n \t\t\t      const u8 *buf, size_t len,\n \t\t\t      const u8 *dest, __be16 proto, bool unencrypted,\n-\t\t\t      int link_id, u64 *cookie);\n+\t\t\t      int link_id, u64 cookie);\n int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,\n \t\t\t      const u8 *buf, size_t len);\n void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,\ndiff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c\nindex 2bceb73717c66..7acef80d5f1fb 100644\n--- a/net/mac80211/offchannel.c\n+++ b/net/mac80211/offchannel.c\n@@ -602,14 +602,12 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,\n \n \t/*\n \t * cookie is either the roc cookie (for normal roc)\n-\t * or the SKB (for mgmt TX)\n+\t * or the mgmt_tx cookie; both are pre-assigned by cfg80211\n \t */\n-\tif (!txskb) {\n-\t\troc-\u003ecookie = ieee80211_mgmt_tx_cookie(local);\n-\t\t*cookie = roc-\u003ecookie;\n-\t} else {\n+\tif (!txskb)\n+\t\troc-\u003ecookie = *cookie;\n+\telse\n \t\troc-\u003emgmt_tx_cookie = *cookie;\n-\t}\n \n \treq = wiphy_dereference(local-\u003ehw.wiphy, local-\u003escan_req);\n \n@@ -704,7 +702,7 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,\n \n int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t\t\tstruct ieee80211_channel *chan,\n-\t\t\t\tunsigned int duration, u64 *cookie,\n+\t\t\t\tunsigned int duration, u64 cookie,\n \t\t\t\tconst u8 *rx_addr)\n {\n \tstruct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);\n@@ -713,7 +711,7 @@ int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,\n \tlockdep_assert_wiphy(local-\u003ehw.wiphy);\n \n \treturn ieee80211_start_roc_work(local, sdata, chan,\n-\t\t\t\t\tduration, cookie, NULL,\n+\t\t\t\t\tduration, \u0026cookie, NULL,\n \t\t\t\t\tIEEE80211_ROC_TYPE_NORMAL);\n }\n \n@@ -810,7 +808,7 @@ int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,\n }\n \n int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n-\t\t      struct cfg80211_mgmt_tx_params *params, u64 *cookie)\n+\t\t      struct cfg80211_mgmt_tx_params *params, u64 cookie)\n {\n \tstruct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);\n \tstruct ieee80211_local *local = sdata-\u003elocal;\n@@ -1016,18 +1014,11 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \t\t/* make a copy to preserve the frame contents\n \t\t * in case of encryption.\n \t\t */\n-\t\tret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_KERNEL);\n+\t\tret = ieee80211_attach_ack_skb(local, skb, \u0026cookie, GFP_KERNEL);\n \t\tif (ret) {\n \t\t\tkfree_skb(skb);\n \t\t\tgoto out_unlock;\n \t\t}\n-\t} else {\n-\t\t/* Assign a dummy non-zero cookie, it's not sent to\n-\t\t * userspace in this case but we rely on its value\n-\t\t * internally in the need_offchan case to distinguish\n-\t\t * mgmt-tx from remain-on-channel.\n-\t\t */\n-\t\t*cookie = 0xffffffff;\n \t}\n \n \tif (!need_offchan) {\n@@ -1044,7 +1035,7 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n \n \t/* This will handle all kinds of coalescing and immediate TX */\n \tret = ieee80211_start_roc_work(local, sdata, params-\u003echan,\n-\t\t\t\t       params-\u003ewait, cookie, skb,\n+\t\t\t\t       params-\u003ewait, \u0026cookie, skb,\n \t\t\t\t       IEEE80211_ROC_TYPE_MGMT_TX);\n \tif (ret)\n \t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\ndiff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c\nindex ffd575a8d188f..dc2f662fe4c46 100644\n--- a/net/mac80211/tdls.c\n+++ b/net/mac80211/tdls.c\n@@ -1121,7 +1121,7 @@ ieee80211_tdls_prep_mgmt_packet(struct wiphy *wiphy, struct net_device *dev,\n \t/* disable bottom halves when entering the Tx path */\n \tlocal_bh_disable();\n \t__ieee80211_subif_start_xmit(skb, dev, flags,\n-\t\t\t\t     IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, NULL);\n+\t\t\t\t     IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, 0);\n \tlocal_bh_enable();\n \n \treturn ret;\ndiff --git a/net/mac80211/tx.c b/net/mac80211/tx.c\nindex 0cf5f6ec75e67..454a872b259a3 100644\n--- a/net/mac80211/tx.c\n+++ b/net/mac80211/tx.c\n@@ -2583,7 +2583,7 @@ int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,\n static u16 ieee80211_store_ack_skb(struct ieee80211_local *local,\n \t\t\t\t   struct sk_buff *skb,\n \t\t\t\t   u32 *info_flags,\n-\t\t\t\t   u64 *cookie)\n+\t\t\t\t   u64 cookie)\n {\n \tstruct sk_buff *ack_skb;\n \tu16 info_id = 0;\n@@ -2605,10 +2605,8 @@ static u16 ieee80211_store_ack_skb(struct ieee80211_local *local,\n \t\tif (id \u003e= 0) {\n \t\t\tinfo_id = id;\n \t\t\t*info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;\n-\t\t\tif (cookie) {\n-\t\t\t\t*cookie = ieee80211_mgmt_tx_cookie(local);\n-\t\t\t\tIEEE80211_SKB_CB(ack_skb)-\u003eack.cookie = *cookie;\n-\t\t\t}\n+\t\t\tif (cookie)\n+\t\t\t\tIEEE80211_SKB_CB(ack_skb)-\u003eack.cookie = cookie;\n \t\t} else {\n \t\t\tkfree_skb(ack_skb);\n \t\t}\n@@ -2653,7 +2651,7 @@ static void ieee80211_remove_ack_skb(struct ieee80211_local *local, u16 info_id)\n static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,\n \t\t\t\t\t   struct sk_buff *skb, u32 info_flags,\n \t\t\t\t\t   struct sta_info *sta, u32 ctrl_flags,\n-\t\t\t\t\t   u64 *cookie)\n+\t\t\t\t\t   u64 cookie)\n {\n \tstruct ieee80211_local *local = sdata-\u003elocal;\n \tstruct ieee80211_tx_info *info;\n@@ -4374,7 +4372,7 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,\n \t\t\t\t  struct net_device *dev,\n \t\t\t\t  u32 info_flags,\n \t\t\t\t  u32 ctrl_flags,\n-\t\t\t\t  u64 *cookie)\n+\t\t\t\t  u64 cookie)\n {\n \tstruct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);\n \tstruct ieee80211_local *local = sdata-\u003elocal;\n@@ -4569,7 +4567,7 @@ static void ieee80211_mlo_multicast_tx_one(struct ieee80211_sub_if_data *sdata,\n \t\treturn;\n \n \tctrl_flags |= u32_encode_bits(link_id, IEEE80211_TX_CTRL_MLO_LINK);\n-\t__ieee80211_subif_start_xmit(out, sdata-\u003edev, 0, ctrl_flags, NULL);\n+\t__ieee80211_subif_start_xmit(out, sdata-\u003edev, 0, ctrl_flags, 0);\n }\n \n static void ieee80211_mlo_multicast_tx(struct net_device *dev,\n@@ -4584,8 +4582,7 @@ static void ieee80211_mlo_multicast_tx(struct net_device *dev,\n \t\tctrl_flags |= u32_encode_bits(__ffs(links),\n \t\t\t\t\t      IEEE80211_TX_CTRL_MLO_LINK);\n \n-\t\t__ieee80211_subif_start_xmit(skb, sdata-\u003edev, 0, ctrl_flags,\n-\t\t\t\t\t     NULL);\n+\t\t__ieee80211_subif_start_xmit(skb, sdata-\u003edev, 0, ctrl_flags, 0);\n \t\treturn;\n \t}\n \n@@ -4627,7 +4624,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,\n \t\twhile ((skb = __skb_dequeue(\u0026queue)))\n \t\t\t__ieee80211_subif_start_xmit(skb, dev, 0,\n \t\t\t\t\t\t     IEEE80211_TX_CTRL_MLO_LINK_UNSPEC,\n-\t\t\t\t\t\t     NULL);\n+\t\t\t\t\t\t     0);\n \t} else if (ieee80211_vif_is_mld(\u0026sdata-\u003evif) \u0026\u0026\n \t\t   ((sdata-\u003evif.type == NL80211_IFTYPE_AP \u0026\u0026\n \t\t     !ieee80211_hw_check(\u0026sdata-\u003elocal-\u003ehw, MLO_MCAST_MULTI_LINK_TX)) ||\n@@ -4638,7 +4635,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,\n normal:\n \t\t__ieee80211_subif_start_xmit(skb, dev, 0,\n \t\t\t\t\t     IEEE80211_TX_CTRL_MLO_LINK_UNSPEC,\n-\t\t\t\t\t     NULL);\n+\t\t\t\t\t     0);\n \t}\n \n \treturn NETDEV_TX_OK;\n@@ -4737,7 +4734,7 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,\n \t\t\t/* fall back to non-offload slow path */\n \t\t\t__ieee80211_subif_start_xmit(skb, dev, 0,\n \t\t\t\t\t\t     IEEE80211_TX_CTRL_MLO_LINK_UNSPEC,\n-\t\t\t\t\t\t     NULL);\n+\t\t\t\t\t\t     0);\n \t\t\treturn;\n \t\t}\n \n@@ -4773,7 +4770,7 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,\n \n \tif (unlikely(sk_requests_wifi_status(skb-\u003esk))) {\n \t\tinfo-\u003estatus_data = ieee80211_store_ack_skb(local, skb,\n-\t\t\t\t\t\t\t    \u0026info-\u003eflags, NULL);\n+\t\t\t\t\t\t\t    \u0026info-\u003eflags, 0);\n \t\tif (info-\u003estatus_data)\n \t\t\tinfo-\u003estatus_data_idr = 1;\n \t}\n@@ -4916,7 +4913,7 @@ ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,\n \t}\n \n \tskb = ieee80211_build_hdr(sdata, skb, info_flags, sta,\n-\t\t\t\t  IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, NULL);\n+\t\t\t\t  IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, 0);\n \tif (IS_ERR(skb))\n \t\tgoto out;\n \n@@ -6531,7 +6528,7 @@ void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,\n int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,\n \t\t\t      const u8 *buf, size_t len,\n \t\t\t      const u8 *dest, __be16 proto, bool unencrypted,\n-\t\t\t      int link_id, u64 *cookie)\n+\t\t\t      int link_id, u64 cookie)\n {\n \tstruct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);\n \tstruct ieee80211_local *local = sdata-\u003elocal;\n@@ -6666,7 +6663,7 @@ int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,\n \tlocal_bh_disable();\n \t__ieee80211_subif_start_xmit(skb, skb-\u003edev, 0,\n \t\t\t\t     IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP,\n-\t\t\t\t     NULL);\n+\t\t\t\t     0);\n \tlocal_bh_enable();\n \n \treturn 0;\ndiff --git a/net/wireless/core.h b/net/wireless/core.h\nindex 15d9f7eb58b4d..b4610f6685dcb 100644\n--- a/net/wireless/core.h\n+++ b/net/wireless/core.h\n@@ -402,7 +402,7 @@ void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev);\n int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,\n \t\t\t  struct wireless_dev *wdev,\n \t\t\t  struct cfg80211_mgmt_tx_params *params,\n-\t\t\t  u64 *cookie);\n+\t\t\t  u64 cookie);\n void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,\n \t\t\t       const struct ieee80211_ht_cap *ht_capa_mask);\n void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,\ndiff --git a/net/wireless/mlme.c b/net/wireless/mlme.c\nindex 7824b7ac2770f..a0d1cde26f0c9 100644\n--- a/net/wireless/mlme.c\n+++ b/net/wireless/mlme.c\n@@ -894,7 +894,7 @@ static bool cfg80211_allowed_random_address(struct wireless_dev *wdev,\n \n int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,\n \t\t\t  struct wireless_dev *wdev,\n-\t\t\t  struct cfg80211_mgmt_tx_params *params, u64 *cookie)\n+\t\t\t  struct cfg80211_mgmt_tx_params *params, u64 cookie)\n {\n \tconst struct ieee80211_mgmt *mgmt;\n \tu16 stype;\ndiff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c\nindex 8adbef5f04425..ac895e02cd411 100644\n--- a/net/wireless/nl80211.c\n+++ b/net/wireless/nl80211.c\n@@ -14642,8 +14642,9 @@ static int nl80211_remain_on_channel(struct sk_buff *skb,\n \t\tgoto free_msg;\n \t}\n \n+\tcookie = cfg80211_assign_cookie(rdev);\n \terr = rdev_remain_on_channel(rdev, wdev, chandef.chan,\n-\t\t\t\t     duration, \u0026cookie, rx_addr);\n+\t\t\t\t     duration, cookie, rx_addr);\n \n \tif (err)\n \t\tgoto free_msg;\n@@ -14883,7 +14884,8 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)\n \t}\n \n \tparams.chan = chandef.chan;\n-\terr = cfg80211_mlme_mgmt_tx(rdev, wdev, \u0026params, \u0026cookie);\n+\tcookie = cfg80211_assign_cookie(rdev);\n+\terr = cfg80211_mlme_mgmt_tx(rdev, wdev, \u0026params, cookie);\n \tif (err)\n \t\tgoto free_msg;\n \n@@ -16371,7 +16373,8 @@ static int nl80211_probe_peer(struct sk_buff *skb, struct genl_info *info)\n \t\tgoto free_msg;\n \t}\n \n-\terr = rdev_probe_peer(rdev, dev, addr, \u0026cookie);\n+\tcookie = cfg80211_assign_cookie(rdev);\n+\terr = rdev_probe_peer(rdev, dev, addr, cookie);\n \tif (err)\n \t\tgoto free_msg;\n \n@@ -18586,10 +18589,11 @@ static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)\n \n \tlink_id = nl80211_link_id_or_invalid(info-\u003eattrs);\n \n+\tcookie = dont_wait_for_ack ? 0 : cfg80211_assign_cookie(rdev);\n \terr = rdev_tx_control_port(rdev, dev, buf, len,\n \t\t\t\t   dest, cpu_to_be16(proto), noencrypt, link_id,\n-\t\t\t\t   dont_wait_for_ack ? NULL : \u0026cookie);\n-\tif (!err \u0026\u0026 !dont_wait_for_ack)\n+\t\t\t\t   cookie);\n+\tif (!err \u0026\u0026 cookie)\n \t\tnl_set_extack_cookie_u64(info-\u003eextack, cookie);\n \treturn err;\n }\n@@ -22042,6 +22046,10 @@ static void nl80211_frame_tx_status(struct wireless_dev *wdev,\n \tstruct sk_buff *msg;\n \tvoid *hdr;\n \n+\t/* userspace not interested in zero-cookie status */\n+\tif (!status-\u003ecookie)\n+\t\treturn;\n+\n \tif (command == NL80211_CMD_FRAME_TX_STATUS)\n \t\ttrace_cfg80211_mgmt_tx_status(wdev, status-\u003ecookie,\n \t\t\t\t\t      status-\u003eack);\ndiff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h\nindex 6c3bad8b2d6f6..46849fe8d0b39 100644\n--- a/net/wireless/rdev-ops.h\n+++ b/net/wireless/rdev-ops.h\n@@ -736,14 +736,14 @@ static inline int\n rdev_remain_on_channel(struct cfg80211_registered_device *rdev,\n \t\t       struct wireless_dev *wdev,\n \t\t       struct ieee80211_channel *chan,\n-\t\t       unsigned int duration, u64 *cookie, const u8 *rx_addr)\n+\t\t       unsigned int duration, u64 cookie, const u8 *rx_addr)\n {\n \tint ret;\n \ttrace_rdev_remain_on_channel(\u0026rdev-\u003ewiphy, wdev, chan, duration,\n \t\t\t\t     rx_addr);\n \tret = rdev-\u003eops-\u003eremain_on_channel(\u0026rdev-\u003ewiphy, wdev, chan,\n \t\t\t\t\t   duration, cookie, rx_addr);\n-\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, *cookie);\n+\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, cookie);\n \treturn ret;\n }\n \n@@ -761,12 +761,12 @@ rdev_cancel_remain_on_channel(struct cfg80211_registered_device *rdev,\n static inline int rdev_mgmt_tx(struct cfg80211_registered_device *rdev,\n \t\t\t       struct wireless_dev *wdev,\n \t\t\t       struct cfg80211_mgmt_tx_params *params,\n-\t\t\t       u64 *cookie)\n+\t\t\t       u64 cookie)\n {\n \tint ret;\n \ttrace_rdev_mgmt_tx(\u0026rdev-\u003ewiphy, wdev, params);\n \tret = rdev-\u003eops-\u003emgmt_tx(\u0026rdev-\u003ewiphy, wdev, params, cookie);\n-\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, *cookie);\n+\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, cookie);\n \treturn ret;\n }\n \n@@ -775,7 +775,7 @@ static inline int rdev_tx_control_port(struct cfg80211_registered_device *rdev,\n \t\t\t\t       const void *buf, size_t len,\n \t\t\t\t       const u8 *dest, __be16 proto,\n \t\t\t\t       const bool noencrypt, int link,\n-\t\t\t\t       u64 *cookie)\n+\t\t\t\t       u64 cookie)\n {\n \tint ret;\n \ttrace_rdev_tx_control_port(\u0026rdev-\u003ewiphy, dev, buf, len,\n@@ -783,7 +783,7 @@ static inline int rdev_tx_control_port(struct cfg80211_registered_device *rdev,\n \tret = rdev-\u003eops-\u003etx_control_port(\u0026rdev-\u003ewiphy, dev, buf, len,\n \t\t\t\t\t dest, proto, noencrypt, link, cookie);\n \tif (cookie)\n-\t\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, *cookie);\n+\t\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, cookie);\n \telse\n \t\ttrace_rdev_return_int(\u0026rdev-\u003ewiphy, ret);\n \treturn ret;\n@@ -950,12 +950,12 @@ static inline int rdev_tdls_oper(struct cfg80211_registered_device *rdev,\n \n static inline int rdev_probe_peer(struct cfg80211_registered_device *rdev,\n \t\t\t\t  struct net_device *dev, const u8 *peer,\n-\t\t\t\t  u64 *cookie)\n+\t\t\t\t  u64 cookie)\n {\n \tint ret;\n \ttrace_rdev_probe_peer(\u0026rdev-\u003ewiphy, dev, peer);\n \tret = rdev-\u003eops-\u003eprobe_peer(\u0026rdev-\u003ewiphy, dev, peer, cookie);\n-\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, *cookie);\n+\ttrace_rdev_return_int_cookie(\u0026rdev-\u003ewiphy, ret, cookie);\n \treturn ret;\n }\n \n"
}

{
  "EnableConfigs": [
    "CFG80211",
    "MAC80211",
    "MAC80211_HWSIM"
  ],
  "FocusSymbols": [
    "nl80211_remain_on_channel",
    "nl80211_tx_mgmt",
    "nl80211_probe_peer",
    "nl80211_tx_control_port",
    "cfg80211_mlme_mgmt_tx",
    "ieee80211_remain_on_channel",
    "ieee80211_mgmt_tx",
    "ieee80211_probe_peer",
    "ieee80211_tx_control_port",
    "ieee80211_attach_ack_skb",
    "ieee80211_start_roc_work"
  ],
  "Reasoning": "The patch changes how cookies are generated and passed for several nl80211 commands (remain_on_channel, tx_mgmt, probe_peer, tx_control_port). It modifies the core cfg80211 and mac80211 logic to generate cookies in nl80211 and pass them by value to drivers, instead of having drivers generate them and pass them back via pointers. This is a functional change to the core wireless stack and should be fuzzed.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit db647f403d99a4369043df3c05eea5ddf840805d
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Aug 1 19:22:36 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index ecde91159b546..34025d64d6158 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -3034,20 +3034,14 @@ static int ath6kl_remain_on_channel(struct wiphy *wiphy,
 				    struct wireless_dev *wdev,
 				    struct ieee80211_channel *chan,
 				    unsigned int duration,
-				    u64 *cookie, const u8 *rx_addr)
+				    u64 cookie, const u8 *rx_addr)
 {
 	struct ath6kl_vif *vif = ath6kl_vif_from_wdev(wdev);
 	struct ath6kl *ar = ath6kl_priv(vif->ndev);
-	u32 id;
 
 	/* TODO: if already pending or ongoing remain-on-channel,
 	 * return -EBUSY */
-	id = ++vif->last_roc_id;
-	if (id == 0) {
-		/* Do not use 0 as the cookie value */
-		id = ++vif->last_roc_id;
-	}
-	*cookie = id;
+	vif->last_roc_id = cookie;
 
 	return ath6kl_wmi_remain_on_chnl_cmd(ar->wmi, vif->fw_vif_idx,
 					     chan->center_freq, duration);
@@ -3106,6 +3100,7 @@ static int ath6kl_send_go_probe_resp(struct ath6kl_vif *vif,
 
 static bool ath6kl_mgmt_powersave_ap(struct ath6kl_vif *vif,
 				     u32 id,
+				     u64 cookie,
 				     u32 freq,
 				     u32 wait,
 				     const u8 *buf,
@@ -3138,6 +3133,7 @@ static bool ath6kl_mgmt_powersave_ap(struct ath6kl_vif *vif,
 
 			INIT_LIST_HEAD(&mgmt_buf->list);
 			mgmt_buf->id = id;
+			mgmt_buf->cookie = cookie;
 			mgmt_buf->freq = freq;
 			mgmt_buf->wait = wait;
 			mgmt_buf->len = len;
@@ -3190,7 +3186,7 @@ static bool ath6kl_is_p2p_go_ssid(const u8 *buf, size_t len)
 }
 
 static int ath6kl_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-			  struct cfg80211_mgmt_tx_params *params, u64 *cookie)
+			  struct cfg80211_mgmt_tx_params *params, u64 cookie)
 {
 	struct ath6kl_vif *vif = ath6kl_vif_from_wdev(wdev);
 	struct ath6kl *ar = ath6kl_priv(vif->ndev);
@@ -3222,7 +3218,6 @@ static int ath6kl_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 		 * Send Probe Response frame in GO mode using a separate WMI
 		 * command to allow the target to fill in the generic IEs.
 		 */
-		*cookie = 0; /* TX status not supported */
 		return ath6kl_send_go_probe_resp(vif, buf, len, freq);
 	}
 
@@ -3235,16 +3230,15 @@ static int ath6kl_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 		id = vif->send_action_id++;
 	}
 
-	*cookie = id;
-
 	/* AP mode Power saving processing */
 	if (vif->nw_type == AP_NETWORK) {
-		queued = ath6kl_mgmt_powersave_ap(vif, id, freq, wait, buf, len,
-						  &more_data, no_cck);
+		queued = ath6kl_mgmt_powersave_ap(vif, id, cookie, freq, wait,
+						  buf, len, &more_data, no_cck);
 		if (queued)
 			return 0;
 	}
 
+	ar->wmi->last_mgmt_tx_cookie = cookie;
 	return ath6kl_wmi_send_mgmt_cmd(ar->wmi, vif->fw_vif_idx, id, freq,
 					wait, buf, len, no_cck);
 }
diff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h
index 77e052336eb5b..a0b236eeeab54 100644
--- a/drivers/net/wireless/ath/ath6kl/core.h
+++ b/drivers/net/wireless/ath/ath6kl/core.h
@@ -404,6 +404,7 @@ struct ath6kl_mgmt_buff {
 	u32 freq;
 	u32 wait;
 	u32 id;
+	u64 cookie;
 	bool no_cck;
 	size_t len;
 	u8 buf[];
@@ -631,8 +632,8 @@ struct ath6kl_vif {
 	struct cfg80211_scan_request *scan_req;
 	enum sme_state sme_state;
 	int reconnect_flag;
-	u32 last_roc_id;
-	u32 last_cancel_roc_id;
+	u64 last_roc_id;
+	u64 last_cancel_roc_id;
 	u32 send_action_id;
 	bool probe_req_report;
 	u16 assoc_bss_beacon_int;
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index 8afc6589fc51e..9c023d7ce3059 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -898,6 +898,7 @@ void ath6kl_pspoll_event(struct ath6kl_vif *vif, u8 aid)
 		spin_unlock_bh(&conn->psq_lock);
 
 		conn->sta_flags |= STA_PS_POLLED;
+		ar->wmi->last_mgmt_tx_cookie = mgmt_buf->cookie;
 		ath6kl_wmi_send_mgmt_cmd(ar->wmi, vif->fw_vif_idx,
 					 mgmt_buf->id, mgmt_buf->freq,
 					 mgmt_buf->wait, mgmt_buf->buf,
diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index d818254139061..609d458ca6c57 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -1469,6 +1469,7 @@ void ath6kl_rx(struct htc_target *target, struct htc_packet *packet)
 					spin_unlock_bh(&conn->psq_lock);
 					idx = vif->fw_vif_idx;
 
+					ar->wmi->last_mgmt_tx_cookie = mgmt->cookie;
 					ath6kl_wmi_send_mgmt_cmd(ar->wmi,
 								 idx,
 								 mgmt->id,
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 6c29f0bcec9f5..2140fddba8baf 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -596,7 +596,7 @@ static int ath6kl_wmi_tx_status_event_rx(struct wmi *wmi, u8 *datap, int len,
 	ath6kl_dbg(ATH6KL_DBG_WMI, "tx_status: id=%x ack_status=%u\n",
 		   id, ev->ack_status);
 	if (wmi->last_mgmt_tx_frame) {
-		cfg80211_mgmt_tx_status(&vif->wdev, id,
+		cfg80211_mgmt_tx_status(&vif->wdev, wmi->last_mgmt_tx_cookie,
 					wmi->last_mgmt_tx_frame,
 					wmi->last_mgmt_tx_frame_len,
 					!!ev->ack_status, GFP_ATOMIC);
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.h b/drivers/net/wireless/ath/ath6kl/wmi.h
index 8fbece3fdad9f..89ce2abbb1cdc 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.h
+++ b/drivers/net/wireless/ath/ath6kl/wmi.h
@@ -125,6 +125,7 @@ struct wmi {
 
 	u8 *last_mgmt_tx_frame;
 	size_t last_mgmt_tx_frame_len;
+	u64 last_mgmt_tx_cookie;
 	u8 saved_pwr_mode;
 };
 
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 5f2bd9a31faf6..9ac33d827f801 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -1432,7 +1432,7 @@ static int wil_cfg80211_set_wiphy_params(struct wiphy *wiphy, int radio_idx,
 
 int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 			 struct cfg80211_mgmt_tx_params *params,
-			 u64 *cookie)
+			 u64 cookie)
 {
 	const u8 *buf = params->buf;
 	size_t len = params->len;
@@ -1488,8 +1488,7 @@ int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 	 */
 	tx_status = (rc == 0);
 	rc = (rc == -EAGAIN) ? 0 : rc;
-	cfg80211_mgmt_tx_status(wdev, cookie ? *cookie : 0, buf, len,
-				tx_status, GFP_KERNEL);
+	cfg80211_mgmt_tx_status(wdev, cookie, buf, len, tx_status, GFP_KERNEL);
 
 	return rc;
 }
@@ -1735,7 +1734,7 @@ static int wil_remain_on_channel(struct wiphy *wiphy,
 				 struct wireless_dev *wdev,
 				 struct ieee80211_channel *chan,
 				 unsigned int duration,
-				 u64 *cookie, const u8 *rx_addr)
+				 u64 cookie, const u8 *rx_addr)
 {
 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 	int rc;
@@ -2381,7 +2380,7 @@ void wil_probe_client_flush(struct wil6210_vif *vif)
 
 static int wil_cfg80211_probe_peer(struct wiphy *wiphy,
 				   struct net_device *dev,
-				   const u8 *peer, u64 *cookie)
+				   const u8 *peer, u64 cookie)
 {
 	struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 	struct wil6210_vif *vif = ndev_to_vif(dev);
@@ -2399,13 +2398,12 @@ static int wil_cfg80211_probe_peer(struct wiphy *wiphy,
 		return -ENOMEM;
 
 	req->cid = cid;
-	req->cookie = cid;
+	req->cookie = cookie;
 
 	mutex_lock(&vif->probe_client_mutex);
 	list_add_tail(&req->list, &vif->probe_client_pending);
 	mutex_unlock(&vif->probe_client_mutex);
 
-	*cookie = req->cookie;
 	queue_work(wil->wq_service, &vif->probe_client_worker);
 	return 0;
 }
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index b8cb736a71852..e06e45323272c 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -985,7 +985,7 @@ static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf,
 	params.buf = frame;
 	params.len = len;
 
-	rc = wil_cfg80211_mgmt_tx(wiphy, wdev, &params, NULL);
+	rc = wil_cfg80211_mgmt_tx(wiphy, wdev, &params, 0);
 
 	kfree(frame);
 	wil_info(wil, "-> %d\n", rc);
diff --git a/drivers/net/wireless/ath/wil6210/p2p.c b/drivers/net/wireless/ath/wil6210/p2p.c
index f20caf1a3905b..acd8a2e351032 100644
--- a/drivers/net/wireless/ath/wil6210/p2p.c
+++ b/drivers/net/wireless/ath/wil6210/p2p.c
@@ -124,7 +124,7 @@ int wil_p2p_search(struct wil6210_vif *vif,
 
 int wil_p2p_listen(struct wil6210_priv *wil, struct wireless_dev *wdev,
 		   unsigned int duration, struct ieee80211_channel *chan,
-		   u64 *cookie)
+		   u64 cookie)
 {
 	struct wil6210_vif *vif = wdev_to_vif(wil, wdev);
 	struct wil_p2p_info *p2p = &vif->p2p;
@@ -144,7 +144,7 @@ int wil_p2p_listen(struct wil6210_priv *wil, struct wireless_dev *wdev,
 	}
 
 	memcpy(&p2p->listen_chan, chan, sizeof(*chan));
-	*cookie = ++p2p->cookie;
+	p2p->cookie = cookie;
 	p2p->listen_duration = duration;
 
 	mutex_lock(&wil->vif_mutex);
@@ -166,7 +166,7 @@ int wil_p2p_listen(struct wil6210_priv *wil, struct wireless_dev *wdev,
 	if (vif->mid == 0)
 		wil->radio_wdev = wdev;
 
-	cfg80211_ready_on_channel(wdev, *cookie, chan, duration,
+	cfg80211_ready_on_channel(wdev, cookie, chan, duration,
 				  GFP_KERNEL);
 
 out:
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index 31e107c81e2d4..f8e60be631ca5 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -1301,7 +1301,7 @@ int wil_p2p_search(struct wil6210_vif *vif,
 		   struct cfg80211_scan_request *request);
 int wil_p2p_listen(struct wil6210_priv *wil, struct wireless_dev *wdev,
 		   unsigned int duration, struct ieee80211_channel *chan,
-		   u64 *cookie);
+		   u64 cookie);
 u8 wil_p2p_stop_discovery(struct wil6210_vif *vif);
 int wil_p2p_cancel_listen(struct wil6210_vif *vif, u64 cookie);
 void wil_p2p_listen_expired(struct work_struct *work);
@@ -1317,7 +1317,7 @@ int wmi_stop_discovery(struct wil6210_vif *vif);
 
 int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 			 struct cfg80211_mgmt_tx_params *params,
-			 u64 *cookie);
+			 u64 cookie);
 void wil_cfg80211_ap_recovery(struct wil6210_priv *wil);
 int wil_cfg80211_iface_combinations_from_fw(
 	struct wil6210_priv *wil,
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 6b2c34e3a796c..872c48806d091 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -5554,7 +5554,7 @@ brcmf_cfg80211_update_mgmt_frame_registrations(struct wiphy *wiphy,
 
 int
 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-		       struct cfg80211_mgmt_tx_params *params, u64 *cookie)
+		       struct cfg80211_mgmt_tx_params *params, u64 cookie)
 {
 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 	struct ieee80211_channel *chan = params->chan;
@@ -5573,8 +5573,6 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 
 	brcmf_dbg(TRACE, "Enter\n");
 
-	*cookie = 0;
-
 	mgmt = (const struct ieee80211_mgmt *)buf;
 
 	if (!ieee80211_is_mgmt(mgmt->frame_control)) {
@@ -5605,7 +5603,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 					    BRCMF_VNDR_IE_PRBRSP_FLAG,
 					    &buf[ie_offset],
 					    ie_len);
-		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
+		cfg80211_mgmt_tx_status(wdev, cookie, buf, len, true,
 					GFP_KERNEL);
 	} else if (ieee80211_is_action(mgmt->frame_control)) {
 		if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
@@ -5621,7 +5619,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 		}
 		action_frame = &af_params->action_frame;
 		/* Add the packet Id */
-		action_frame->packet_id = cpu_to_le32(*cookie);
+		action_frame->packet_id = cpu_to_le32(cookie);
 		/* Add BSSID */
 		memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
 		memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
@@ -5649,12 +5647,12 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 		       le16_to_cpu(action_frame->len));
 
 		brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, channel=%d\n",
-			  *cookie, le16_to_cpu(action_frame->len),
+			  cookie, le16_to_cpu(action_frame->len),
 			  le32_to_cpu(af_params->channel));
 
 		ack = brcmf_p2p_send_action_frame(vif->ifp, af_params);
 
-		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
+		cfg80211_mgmt_tx_status(wdev, cookie, buf, len, ack,
 					GFP_KERNEL);
 free:
 		kfree(af_params);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
index 6ceb301429054..63e534523f518 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
@@ -497,6 +497,6 @@ void brcmf_cfg80211_free_vif(struct net_device *ndev);
 
 int brcmf_set_wsec(struct brcmf_if *ifp, const u8 *key, u16 key_len, u16 flags);
 int brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-			   struct cfg80211_mgmt_tx_params *params, u64 *cookie);
+			   struct cfg80211_mgmt_tx_params *params, u64 cookie);
 
 #endif /* BRCMFMAC_CFG80211_H */
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
index 873754be5174b..545eb9aae9660 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
@@ -100,7 +100,7 @@ static int brcmf_cyw_activate_events(struct brcmf_if *ifp)
 
 static
 int brcmf_cyw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-		      struct cfg80211_mgmt_tx_params *params, u64 *cookie)
+		      struct cfg80211_mgmt_tx_params *params, u64 cookie)
 {
 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
 	struct ieee80211_channel *chan = params->chan;
@@ -123,7 +123,6 @@ int brcmf_cyw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 	if (!ieee80211_is_auth(mgmt->frame_control))
 		return brcmf_cfg80211_mgmt_tx(wiphy, wdev, params, cookie);
 
-	*cookie = 0;
 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 
 	reinit_completion(&vif->mgmt_tx);
@@ -155,7 +154,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 
 	memcpy(&mf_params->da[0], &mgmt->da[0], ETH_ALEN);
 	memcpy(&mf_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
-	mf_params->packet_id = cpu_to_le32(*cookie);
+	mf_params->packet_id = cpu_to_le32(cookie);
 	memcpy(mf_params->data, &buf[DOT11_MGMT_HDR_LEN],
 	       le16_to_cpu(mf_params->len));
 
@@ -187,8 +186,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 	}
 
 tx_status:
-	cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
-				GFP_KERNEL);
+	cfg80211_mgmt_tx_status(wdev, cookie, buf, len, ack, GFP_KERNEL);
 free:
 	kfree(mf_params);
 	return err;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index c7d7b35ab1253..32a015d6b7698 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -979,10 +979,8 @@ brcmf_p2p_discover_listen(struct brcmf_p2p_info *p2p, u16 channel, u32 duration)
 	p2p->cfg->d11inf.encchspec(&ch);
 	err = brcmf_p2p_set_discover_state(vif->ifp, WL_P2P_DISC_ST_LISTEN,
 					   ch.chspec, (u16)duration);
-	if (!err) {
+	if (!err)
 		set_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status);
-		p2p->remain_on_channel_cookie++;
-	}
 exit:
 	return err;
 }
@@ -1000,7 +998,7 @@ brcmf_p2p_discover_listen(struct brcmf_p2p_info *p2p, u16 channel, u32 duration)
  */
 int brcmf_p2p_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
 				struct ieee80211_channel *channel,
-				unsigned int duration, u64 *cookie,
+				unsigned int duration, u64 cookie,
 				const u8 *rx_addr)
 {
 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
@@ -1020,8 +1018,8 @@ int brcmf_p2p_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
 		goto exit;
 
 	memcpy(&p2p->remain_on_channel, channel, sizeof(*channel));
-	*cookie = p2p->remain_on_channel_cookie;
-	cfg80211_ready_on_channel(wdev, *cookie, channel, duration, GFP_KERNEL);
+	p2p->remain_on_channel_cookie = cookie;
+	cfg80211_ready_on_channel(wdev, cookie, channel, duration, GFP_KERNEL);
 
 exit:
 	return err;
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
index 9f3f01ade2b77..7078009491707 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
@@ -157,7 +157,7 @@ int brcmf_p2p_scan_prep(struct wiphy *wiphy,
 			struct brcmf_cfg80211_vif *vif);
 int brcmf_p2p_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
 				struct ieee80211_channel *channel,
-				unsigned int duration, u64 *cookie,
+				unsigned int duration, u64 cookie,
 				const u8 *rx_addr);
 int brcmf_p2p_notify_listen_complete(struct brcmf_if *ifp,
 				     const struct brcmf_event_msg *e,
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 8ec2d22a8c33a..7a1ba32f1fb36 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -196,7 +196,7 @@ mwifiex_form_mgmt_frame(struct sk_buff *skb, const u8 *buf, size_t len)
  */
 static int
 mwifiex_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-			 struct cfg80211_mgmt_tx_params *params, u64 *cookie)
+			 struct cfg80211_mgmt_tx_params *params, u64 cookie)
 {
 	const u8 *buf = params->buf;
 	size_t len = params->len;
@@ -259,14 +259,13 @@ mwifiex_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 	tx_info->pkt_len = pkt_len;
 
 	mwifiex_form_mgmt_frame(skb, buf, len);
-	*cookie = get_random_u32() | 1;
 
 	if (ieee80211_is_action(mgmt->frame_control))
 		skb = mwifiex_clone_skb_for_tx_status(priv,
 						      skb,
-				MWIFIEX_BUF_FLAG_ACTION_TX_STATUS, cookie);
+				MWIFIEX_BUF_FLAG_ACTION_TX_STATUS, &cookie);
 	else
-		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
+		cfg80211_mgmt_tx_status(wdev, cookie, buf, len, true,
 					GFP_ATOMIC);
 
 	mwifiex_queue_tx_pkt(priv, skb);
@@ -304,13 +303,13 @@ static int
 mwifiex_cfg80211_remain_on_channel(struct wiphy *wiphy,
 				   struct wireless_dev *wdev,
 				   struct ieee80211_channel *chan,
-				   unsigned int duration, u64 *cookie,
+				   unsigned int duration, u64 cookie,
 				   const u8 *rx_addr)
 {
 	struct mwifiex_private *priv = mwifiex_netdev_get_priv(wdev->netdev);
 	int ret;
 
-	if (!chan || !cookie) {
+	if (!chan) {
 		mwifiex_dbg(priv->adapter, ERROR, "Invalid parameter for ROC\n");
 		return -EINVAL;
 	}
@@ -326,15 +325,14 @@ mwifiex_cfg80211_remain_on_channel(struct wiphy *wiphy,
 					 duration);
 
 	if (!ret) {
-		*cookie = get_random_u32() | 1;
-		priv->roc_cfg.cookie = *cookie;
+		priv->roc_cfg.cookie = cookie;
 		priv->roc_cfg.chan = *chan;
 
-		cfg80211_ready_on_channel(wdev, *cookie, chan,
+		cfg80211_ready_on_channel(wdev, cookie, chan,
 					  duration, GFP_ATOMIC);
 
 		mwifiex_dbg(priv->adapter, INFO,
-			    "info: ROC, cookie = 0x%llx\n", *cookie);
+			    "info: ROC, cookie = 0x%llx\n", cookie);
 	}
 
 	return ret;
@@ -4560,7 +4558,7 @@ mwifiex_cfg80211_disassociate(struct wiphy *wiphy,
 static int
 mwifiex_cfg80211_probe_peer(struct wiphy *wiphy,
 			    struct net_device *dev, const u8 *peer,
-			    u64 *cookie)
+			    u64 cookie)
 {
 	/* hostapd looks for NL80211_CMD_PROBE_CLIENT support; otherwise,
 	 * it requires monitor-mode support (which mwifiex doesn't support).
diff --git a/drivers/net/wireless/microchip/wilc1000/cfg80211.c b/drivers/net/wireless/microchip/wilc1000/cfg80211.c
index 6654fce4ded84..bb2748a193294 100644
--- a/drivers/net/wireless/microchip/wilc1000/cfg80211.c
+++ b/drivers/net/wireless/microchip/wilc1000/cfg80211.c
@@ -1100,24 +1100,19 @@ static void wilc_wfi_remain_on_channel_expired(struct wilc_vif *vif, u64 cookie)
 static int remain_on_channel(struct wiphy *wiphy,
 			     struct wireless_dev *wdev,
 			     struct ieee80211_channel *chan,
-			     unsigned int duration, u64 *cookie,
+			     unsigned int duration, u64 cookie,
 			     const u8 *rx_addr)
 {
 	int ret = 0;
 	struct wilc_vif *vif = netdev_priv(wdev->netdev);
 	struct wilc_priv *priv = &vif->priv;
-	u64 id;
 
 	if (wdev->iftype == NL80211_IFTYPE_AP) {
 		netdev_dbg(vif->ndev, "Required while in AP mode\n");
 		return ret;
 	}
 
-	id = ++priv->inc_roc_cookie;
-	if (id == 0)
-		id = ++priv->inc_roc_cookie;
-
-	ret = wilc_remain_on_channel(vif, id, chan->hw_value,
+	ret = wilc_remain_on_channel(vif, cookie, chan->hw_value,
 				     wilc_wfi_remain_on_channel_expired);
 	if (ret)
 		return ret;
@@ -1125,12 +1120,11 @@ static int remain_on_channel(struct wiphy *wiphy,
 	vif->wilc->op_ch = chan->hw_value;
 
 	priv->remain_on_ch_params.listen_ch = chan;
-	priv->remain_on_ch_params.listen_cookie = id;
-	*cookie = id;
+	priv->remain_on_ch_params.listen_cookie = cookie;
 	priv->p2p_listen_state = true;
 	priv->remain_on_ch_params.listen_duration = duration;
 
-	cfg80211_ready_on_channel(wdev, *cookie, chan, duration, GFP_KERNEL);
+	cfg80211_ready_on_channel(wdev, cookie, chan, duration, GFP_KERNEL);
 	mod_timer(&vif->hif_drv->remain_on_ch_timer,
 		  jiffies + msecs_to_jiffies(duration + 1000));
 
@@ -1153,7 +1147,7 @@ static int cancel_remain_on_channel(struct wiphy *wiphy,
 static int mgmt_tx(struct wiphy *wiphy,
 		   struct wireless_dev *wdev,
 		   struct cfg80211_mgmt_tx_params *params,
-		   u64 *cookie)
+		   u64 cookie)
 {
 	struct ieee80211_channel *chan = params->chan;
 	unsigned int wait = params->wait;
@@ -1170,8 +1164,7 @@ static int mgmt_tx(struct wiphy *wiphy,
 	const u8 *vendor_ie;
 	int ret = 0;
 
-	*cookie = get_random_u32();
-	priv->tx_cookie = *cookie;
+	priv->tx_cookie = cookie;
 	mgmt = (const struct ieee80211_mgmt *)buf;
 
 	if (!ieee80211_is_mgmt(mgmt->frame_control))
diff --git a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c
index 4f9e20f728114..c820f08d28355 100644
--- a/drivers/net/wireless/nxp/nxpwifi/cfg80211.c
+++ b/drivers/net/wireless/nxp/nxpwifi/cfg80211.c
@@ -150,7 +150,7 @@ nxpwifi_form_mgmt_frame(struct sk_buff *skb, const u8 *buf, size_t len)
 /* cfg80211 operation handler to transmit a management frame. */
 static int
 nxpwifi_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-			 struct cfg80211_mgmt_tx_params *params, u64 *cookie)
+			 struct cfg80211_mgmt_tx_params *params, u64 cookie)
 {
 	const u8 *buf = params->buf;
 	size_t len = params->len;
@@ -212,14 +212,13 @@ nxpwifi_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 	tx_info->pkt_len = pkt_len;
 
 	nxpwifi_form_mgmt_frame(skb, buf, len);
-	*cookie = nxpwifi_roc_cookie(priv->adapter);
 
 	if (ieee80211_is_action(mgmt->frame_control))
 		skb = nxpwifi_clone_skb_for_tx_status(priv,
 						      skb,
-				NXPWIFI_BUF_FLAG_ACTION_TX_STATUS, cookie);
+				NXPWIFI_BUF_FLAG_ACTION_TX_STATUS, &cookie);
 	else
-		cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
+		cfg80211_mgmt_tx_status(wdev, cookie, buf, len, true,
 					GFP_ATOMIC);
 
 	nxpwifi_queue_tx_pkt(priv, skb);
@@ -254,14 +253,14 @@ static int
 nxpwifi_cfg80211_remain_on_channel(struct wiphy *wiphy,
 				   struct wireless_dev *wdev,
 				   struct ieee80211_channel *chan,
-				   unsigned int duration, u64 *cookie,
+				   unsigned int duration, u64 cookie,
 				   const u8 *rx_addr)
 {
 	struct nxpwifi_private *priv = nxpwifi_netdev_get_priv(wdev->netdev);
 	struct nxpwifi_adapter *adapter = priv->adapter;
 	int ret;
 
-	if (!chan || !cookie) {
+	if (!chan) {
 		nxpwifi_dbg(adapter, ERROR, "Invalid parameter for ROC\n");
 		return -EINVAL;
 	}
@@ -277,15 +276,14 @@ nxpwifi_cfg80211_remain_on_channel(struct wiphy *wiphy,
 					 duration);
 
 	if (!ret) {
-		*cookie = nxpwifi_roc_cookie(adapter);
-		priv->roc_cfg.cookie = *cookie;
+		priv->roc_cfg.cookie = cookie;
 		priv->roc_cfg.chan = *chan;
 
-		cfg80211_ready_on_channel(wdev, *cookie, chan,
+		cfg80211_ready_on_channel(wdev, cookie, chan,
 					  duration, GFP_ATOMIC);
 
 		nxpwifi_dbg(adapter, INFO,
-			    "info: ROC, cookie = 0x%llx\n", *cookie);
+			    "info: ROC, cookie = 0x%llx\n", cookie);
 	}
 
 	return ret;
@@ -3618,7 +3616,7 @@ nxpwifi_cfg80211_disassociate(struct wiphy *wiphy,
 static int
 nxpwifi_cfg80211_probe_peer(struct wiphy *wiphy,
 			      struct net_device *dev, const u8 *peer,
-			      u64 *cookie)
+			      u64 cookie)
 {
 	/*
 	 * hostapd looks for NL80211_CMD_PROBE_CLIENT support; otherwise,
diff --git a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
index 9e44c85d2051c..45e2b7ae96333 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
@@ -446,7 +446,7 @@ qtnf_update_mgmt_frame_registrations(struct wiphy *wiphy,
 
 static int
 qtnf_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-	     struct cfg80211_mgmt_tx_params *params, u64 *cookie)
+	     struct cfg80211_mgmt_tx_params *params, u64 cookie)
 {
 	struct qtnf_vif *vif = qtnf_netdev_get_priv(wdev->netdev);
 	const struct ieee80211_mgmt *mgmt_frame = (void *)params->buf;
@@ -454,8 +454,6 @@ qtnf_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 	u16 flags = 0;
 	u16 freq;
 
-	*cookie = short_cookie;
-
 	if (params->offchan)
 		flags |= QLINK_FRAME_TX_FLAG_OFFCHAN;
 
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index 6a97afd89dc78..b58dda129ff66 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -2530,7 +2530,7 @@ static int _cfg80211_rtw_mgmt_tx(struct adapter *padapter, u8 tx_ch, const u8 *b
 
 static int cfg80211_rtw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 				struct cfg80211_mgmt_tx_params *params,
-				u64 *cookie)
+				u64 cookie)
 {
 	struct net_device *ndev = wdev_to_ndev(wdev);
 	struct ieee80211_channel *chan = params->chan;
@@ -2552,11 +2552,8 @@ static int cfg80211_rtw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 
 	padapter = rtw_netdev_priv(ndev);
 
-	/* cookie generation */
-	*cookie = (unsigned long)buf;
-
 	/* indicate ack before issue frame to avoid racing with rsp frame */
-	rtw_cfg80211_mgmt_tx_status(padapter, *cookie, buf, len, ack, GFP_KERNEL);
+	rtw_cfg80211_mgmt_tx_status(padapter, cookie, buf, len, ack, GFP_KERNEL);
 
 	if (!rtw_action_frame_parse(buf, len, &category, &action))
 		goto exit;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index dcbb0e55c32ec..97c16d4ff1271 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5108,7 +5108,8 @@ struct mgmt_frame_regs {
  * @tdls_oper: Perform a high-level TDLS operation (e.g. TDLS link setup).
  *
  * @probe_peer: probe a connected peer (AP: STA MAC required; STA: no MAC),
- *	must return a cookie that is later passed to cfg80211_probe_status().
+ *	must use the @cookie as provided which is later passed to
+ *	cfg80211_probe_status().
  *
  * @set_noack_map: Set the NoAck Map for the TIDs.
  *
@@ -5219,7 +5220,8 @@ struct mgmt_frame_regs {
  *     user space
  *
  * @tx_control_port: TX a control port frame (EAPoL).  The noencrypt parameter
- *	tells the driver that the frame should not be encrypted.
+ *	tells the driver that the frame should not be encrypted. A @cookie
+ *	value of 0 means the caller does not want TX status reporting.
  *
  * @get_ftm_responder_stats: Retrieve FTM responder statistics, if available.
  *	Statistics should be cumulative, currently no way to reset is provided.
@@ -5456,14 +5458,14 @@ struct cfg80211_ops {
 				     struct wireless_dev *wdev,
 				     struct ieee80211_channel *chan,
 				     unsigned int duration,
-				     u64 *cookie, const u8 *rx_addr);
+				     u64 cookie, const u8 *rx_addr);
 	int	(*cancel_remain_on_channel)(struct wiphy *wiphy,
 					    struct wireless_dev *wdev,
 					    u64 cookie);
 
 	int	(*mgmt_tx)(struct wiphy *wiphy, struct wireless_dev *wdev,
 			   struct cfg80211_mgmt_tx_params *params,
-			   u64 *cookie);
+			   u64 cookie);
 	int	(*mgmt_tx_cancel_wait)(struct wiphy *wiphy,
 				       struct wireless_dev *wdev,
 				       u64 cookie);
@@ -5510,7 +5512,7 @@ struct cfg80211_ops {
 			     const u8 *peer, enum nl80211_tdls_operation oper);
 
 	int	(*probe_peer)(struct wiphy *wiphy, struct net_device *dev,
-			      const u8 *peer, u64 *cookie);
+			      const u8 *peer, u64 cookie);
 
 	int	(*set_noack_map)(struct wiphy *wiphy,
 				  struct net_device *dev,
@@ -5608,7 +5610,7 @@ struct cfg80211_ops {
 				   const u8 *buf, size_t len,
 				   const u8 *dest, const __be16 proto,
 				   const bool noencrypt, int link_id,
-				   u64 *cookie);
+				   u64 cookie);
 
 	int	(*get_ftm_responder_stats)(struct wiphy *wiphy,
 				struct net_device *dev,
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 0a9247be26afa..0c2c7afd59c4a 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -4831,19 +4831,6 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
 	return __ieee80211_channel_switch(wiphy, dev, params);
 }
 
-u64 ieee80211_mgmt_tx_cookie(struct ieee80211_local *local)
-{
-	lockdep_assert_wiphy(local->hw.wiphy);
-
-	local->roc_cookie_counter++;
-
-	/* wow, you wrapped 64 bits ... more likely a bug */
-	if (WARN_ON(local->roc_cookie_counter == 0))
-		local->roc_cookie_counter++;
-
-	return local->roc_cookie_counter;
-}
-
 int ieee80211_attach_ack_skb(struct ieee80211_local *local, struct sk_buff *skb,
 			     u64 *cookie, gfp_t gfp)
 {
@@ -4868,7 +4855,6 @@ int ieee80211_attach_ack_skb(struct ieee80211_local *local, struct sk_buff *skb,
 	IEEE80211_SKB_CB(skb)->status_data_idr = 1;
 	IEEE80211_SKB_CB(skb)->status_data = id;
 
-	*cookie = ieee80211_mgmt_tx_cookie(local);
 	IEEE80211_SKB_CB(ack_skb)->ack.cookie = *cookie;
 
 	return 0;
@@ -4954,7 +4940,7 @@ static int ieee80211_set_rekey_data(struct wiphy *wiphy,
 }
 
 static int ieee80211_probe_peer(struct wiphy *wiphy, struct net_device *dev,
-				const u8 *peer, u64 *cookie)
+				const u8 *peer, u64 cookie)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	struct ieee80211_local *local = sdata->local;
@@ -5061,7 +5047,7 @@ static int ieee80211_probe_peer(struct wiphy *wiphy, struct net_device *dev,
 	if (qos)
 		nullfunc->qos_ctrl = cpu_to_le16(7);
 
-	ret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_ATOMIC);
+	ret = ieee80211_attach_ack_skb(local, skb, &cookie, GFP_ATOMIC);
 	if (ret) {
 		kfree_skb(skb);
 		return ret;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index a1ef88fe846dd..5761e96214914 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1710,8 +1710,6 @@ struct ieee80211_local {
 	struct list_head roc_list;
 	struct wiphy_work hw_roc_start, hw_roc_done;
 	unsigned long hw_roc_start_time;
-	u64 roc_cookie_counter;
-
 	struct idr ack_status_frames;
 	spinlock_t ack_status_lock;
 
@@ -1991,7 +1989,6 @@ u64 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
 
 void ieee80211_handle_queued_frames(struct ieee80211_local *local);
 
-u64 ieee80211_mgmt_tx_cookie(struct ieee80211_local *local);
 int ieee80211_attach_ack_skb(struct ieee80211_local *local, struct sk_buff *skb,
 			     u64 *cookie, gfp_t gfp);
 
@@ -2153,12 +2150,12 @@ void ieee80211_roc_purge(struct ieee80211_local *local,
 			 struct ieee80211_sub_if_data *sdata);
 int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
 				struct ieee80211_channel *chan,
-				unsigned int duration, u64 *cookie,
+				unsigned int duration, u64 cookie,
 				const u8 *rx_addr);
 int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
 				       struct wireless_dev *wdev, u64 cookie);
 int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-		      struct cfg80211_mgmt_tx_params *params, u64 *cookie);
+		      struct cfg80211_mgmt_tx_params *params, u64 cookie);
 int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
 				  struct wireless_dev *wdev, u64 cookie);
 
@@ -2237,7 +2234,7 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
 				  struct net_device *dev,
 				  u32 info_flags,
 				  u32 ctrl_flags,
-				  u64 *cookie);
+				  u64 cookie);
 struct sk_buff *
 ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,
 			      struct sk_buff *skb, u32 info_flags);
@@ -2251,7 +2248,7 @@ void ieee80211_clear_fast_xmit(struct sta_info *sta);
 int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
 			      const u8 *buf, size_t len,
 			      const u8 *dest, __be16 proto, bool unencrypted,
-			      int link_id, u64 *cookie);
+			      int link_id, u64 cookie);
 int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
 			      const u8 *buf, size_t len);
 void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 2bceb73717c66..7acef80d5f1fb 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -602,14 +602,12 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
 
 	/*
 	 * cookie is either the roc cookie (for normal roc)
-	 * or the SKB (for mgmt TX)
+	 * or the mgmt_tx cookie; both are pre-assigned by cfg80211
 	 */
-	if (!txskb) {
-		roc->cookie = ieee80211_mgmt_tx_cookie(local);
-		*cookie = roc->cookie;
-	} else {
+	if (!txskb)
+		roc->cookie = *cookie;
+	else
 		roc->mgmt_tx_cookie = *cookie;
-	}
 
 	req = wiphy_dereference(local->hw.wiphy, local->scan_req);
 
@@ -704,7 +702,7 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
 
 int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
 				struct ieee80211_channel *chan,
-				unsigned int duration, u64 *cookie,
+				unsigned int duration, u64 cookie,
 				const u8 *rx_addr)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
@@ -713,7 +711,7 @@ int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
 	lockdep_assert_wiphy(local->hw.wiphy);
 
 	return ieee80211_start_roc_work(local, sdata, chan,
-					duration, cookie, NULL,
+					duration, &cookie, NULL,
 					IEEE80211_ROC_TYPE_NORMAL);
 }
 
@@ -810,7 +808,7 @@ int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
 }
 
 int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-		      struct cfg80211_mgmt_tx_params *params, u64 *cookie)
+		      struct cfg80211_mgmt_tx_params *params, u64 cookie)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 	struct ieee80211_local *local = sdata->local;
@@ -1016,18 +1014,11 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 		/* make a copy to preserve the frame contents
 		 * in case of encryption.
 		 */
-		ret = ieee80211_attach_ack_skb(local, skb, cookie, GFP_KERNEL);
+		ret = ieee80211_attach_ack_skb(local, skb, &cookie, GFP_KERNEL);
 		if (ret) {
 			kfree_skb(skb);
 			goto out_unlock;
 		}
-	} else {
-		/* Assign a dummy non-zero cookie, it's not sent to
-		 * userspace in this case but we rely on its value
-		 * internally in the need_offchan case to distinguish
-		 * mgmt-tx from remain-on-channel.
-		 */
-		*cookie = 0xffffffff;
 	}
 
 	if (!need_offchan) {
@@ -1044,7 +1035,7 @@ int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 
 	/* This will handle all kinds of coalescing and immediate TX */
 	ret = ieee80211_start_roc_work(local, sdata, params->chan,
-				       params->wait, cookie, skb,
+				       params->wait, &cookie, skb,
 				       IEEE80211_ROC_TYPE_MGMT_TX);
 	if (ret)
 		ieee80211_free_txskb(&local->hw, skb);
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index ffd575a8d188f..dc2f662fe4c46 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -1121,7 +1121,7 @@ ieee80211_tdls_prep_mgmt_packet(struct wiphy *wiphy, struct net_device *dev,
 	/* disable bottom halves when entering the Tx path */
 	local_bh_disable();
 	__ieee80211_subif_start_xmit(skb, dev, flags,
-				     IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, NULL);
+				     IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, 0);
 	local_bh_enable();
 
 	return ret;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 0cf5f6ec75e67..454a872b259a3 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2583,7 +2583,7 @@ int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
 static u16 ieee80211_store_ack_skb(struct ieee80211_local *local,
 				   struct sk_buff *skb,
 				   u32 *info_flags,
-				   u64 *cookie)
+				   u64 cookie)
 {
 	struct sk_buff *ack_skb;
 	u16 info_id = 0;
@@ -2605,10 +2605,8 @@ static u16 ieee80211_store_ack_skb(struct ieee80211_local *local,
 		if (id >= 0) {
 			info_id = id;
 			*info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
-			if (cookie) {
-				*cookie = ieee80211_mgmt_tx_cookie(local);
-				IEEE80211_SKB_CB(ack_skb)->ack.cookie = *cookie;
-			}
+			if (cookie)
+				IEEE80211_SKB_CB(ack_skb)->ack.cookie = cookie;
 		} else {
 			kfree_skb(ack_skb);
 		}
@@ -2653,7 +2651,7 @@ static void ieee80211_remove_ack_skb(struct ieee80211_local *local, u16 info_id)
 static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
 					   struct sk_buff *skb, u32 info_flags,
 					   struct sta_info *sta, u32 ctrl_flags,
-					   u64 *cookie)
+					   u64 cookie)
 {
 	struct ieee80211_local *local = sdata->local;
 	struct ieee80211_tx_info *info;
@@ -4374,7 +4372,7 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
 				  struct net_device *dev,
 				  u32 info_flags,
 				  u32 ctrl_flags,
-				  u64 *cookie)
+				  u64 cookie)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	struct ieee80211_local *local = sdata->local;
@@ -4569,7 +4567,7 @@ static void ieee80211_mlo_multicast_tx_one(struct ieee80211_sub_if_data *sdata,
 		return;
 
 	ctrl_flags |= u32_encode_bits(link_id, IEEE80211_TX_CTRL_MLO_LINK);
-	__ieee80211_subif_start_xmit(out, sdata->dev, 0, ctrl_flags, NULL);
+	__ieee80211_subif_start_xmit(out, sdata->dev, 0, ctrl_flags, 0);
 }
 
 static void ieee80211_mlo_multicast_tx(struct net_device *dev,
@@ -4584,8 +4582,7 @@ static void ieee80211_mlo_multicast_tx(struct net_device *dev,
 		ctrl_flags |= u32_encode_bits(__ffs(links),
 					      IEEE80211_TX_CTRL_MLO_LINK);
 
-		__ieee80211_subif_start_xmit(skb, sdata->dev, 0, ctrl_flags,
-					     NULL);
+		__ieee80211_subif_start_xmit(skb, sdata->dev, 0, ctrl_flags, 0);
 		return;
 	}
 
@@ -4627,7 +4624,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 		while ((skb = __skb_dequeue(&queue)))
 			__ieee80211_subif_start_xmit(skb, dev, 0,
 						     IEEE80211_TX_CTRL_MLO_LINK_UNSPEC,
-						     NULL);
+						     0);
 	} else if (ieee80211_vif_is_mld(&sdata->vif) &&
 		   ((sdata->vif.type == NL80211_IFTYPE_AP &&
 		     !ieee80211_hw_check(&sdata->local->hw, MLO_MCAST_MULTI_LINK_TX)) ||
@@ -4638,7 +4635,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 normal:
 		__ieee80211_subif_start_xmit(skb, dev, 0,
 					     IEEE80211_TX_CTRL_MLO_LINK_UNSPEC,
-					     NULL);
+					     0);
 	}
 
 	return NETDEV_TX_OK;
@@ -4737,7 +4734,7 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
 			/* fall back to non-offload slow path */
 			__ieee80211_subif_start_xmit(skb, dev, 0,
 						     IEEE80211_TX_CTRL_MLO_LINK_UNSPEC,
-						     NULL);
+						     0);
 			return;
 		}
 
@@ -4773,7 +4770,7 @@ static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
 
 	if (unlikely(sk_requests_wifi_status(skb->sk))) {
 		info->status_data = ieee80211_store_ack_skb(local, skb,
-							    &info->flags, NULL);
+							    &info->flags, 0);
 		if (info->status_data)
 			info->status_data_idr = 1;
 	}
@@ -4916,7 +4913,7 @@ ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,
 	}
 
 	skb = ieee80211_build_hdr(sdata, skb, info_flags, sta,
-				  IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, NULL);
+				  IEEE80211_TX_CTRL_MLO_LINK_UNSPEC, 0);
 	if (IS_ERR(skb))
 		goto out;
 
@@ -6531,7 +6528,7 @@ void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
 int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
 			      const u8 *buf, size_t len,
 			      const u8 *dest, __be16 proto, bool unencrypted,
-			      int link_id, u64 *cookie)
+			      int link_id, u64 cookie)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	struct ieee80211_local *local = sdata->local;
@@ -6666,7 +6663,7 @@ int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
 	local_bh_disable();
 	__ieee80211_subif_start_xmit(skb, skb->dev, 0,
 				     IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP,
-				     NULL);
+				     0);
 	local_bh_enable();
 
 	return 0;
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 15d9f7eb58b4d..b4610f6685dcb 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -402,7 +402,7 @@ void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev);
 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 			  struct wireless_dev *wdev,
 			  struct cfg80211_mgmt_tx_params *params,
-			  u64 *cookie);
+			  u64 cookie);
 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
 			       const struct ieee80211_ht_cap *ht_capa_mask);
 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 7824b7ac2770f..a0d1cde26f0c9 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -894,7 +894,7 @@ static bool cfg80211_allowed_random_address(struct wireless_dev *wdev,
 
 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 			  struct wireless_dev *wdev,
-			  struct cfg80211_mgmt_tx_params *params, u64 *cookie)
+			  struct cfg80211_mgmt_tx_params *params, u64 cookie)
 {
 	const struct ieee80211_mgmt *mgmt;
 	u16 stype;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 8adbef5f04425..ac895e02cd411 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -14642,8 +14642,9 @@ static int nl80211_remain_on_channel(struct sk_buff *skb,
 		goto free_msg;
 	}
 
+	cookie = cfg80211_assign_cookie(rdev);
 	err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
-				     duration, &cookie, rx_addr);
+				     duration, cookie, rx_addr);
 
 	if (err)
 		goto free_msg;
@@ -14883,7 +14884,8 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
 	}
 
 	params.chan = chandef.chan;
-	err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
+	cookie = cfg80211_assign_cookie(rdev);
+	err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, cookie);
 	if (err)
 		goto free_msg;
 
@@ -16371,7 +16373,8 @@ static int nl80211_probe_peer(struct sk_buff *skb, struct genl_info *info)
 		goto free_msg;
 	}
 
-	err = rdev_probe_peer(rdev, dev, addr, &cookie);
+	cookie = cfg80211_assign_cookie(rdev);
+	err = rdev_probe_peer(rdev, dev, addr, cookie);
 	if (err)
 		goto free_msg;
 
@@ -18586,10 +18589,11 @@ static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
 
 	link_id = nl80211_link_id_or_invalid(info->attrs);
 
+	cookie = dont_wait_for_ack ? 0 : cfg80211_assign_cookie(rdev);
 	err = rdev_tx_control_port(rdev, dev, buf, len,
 				   dest, cpu_to_be16(proto), noencrypt, link_id,
-				   dont_wait_for_ack ? NULL : &cookie);
-	if (!err && !dont_wait_for_ack)
+				   cookie);
+	if (!err && cookie)
 		nl_set_extack_cookie_u64(info->extack, cookie);
 	return err;
 }
@@ -22042,6 +22046,10 @@ static void nl80211_frame_tx_status(struct wireless_dev *wdev,
 	struct sk_buff *msg;
 	void *hdr;
 
+	/* userspace not interested in zero-cookie status */
+	if (!status->cookie)
+		return;
+
 	if (command == NL80211_CMD_FRAME_TX_STATUS)
 		trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
 					      status->ack);
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index 6c3bad8b2d6f6..46849fe8d0b39 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -736,14 +736,14 @@ static inline int
 rdev_remain_on_channel(struct cfg80211_registered_device *rdev,
 		       struct wireless_dev *wdev,
 		       struct ieee80211_channel *chan,
-		       unsigned int duration, u64 *cookie, const u8 *rx_addr)
+		       unsigned int duration, u64 cookie, const u8 *rx_addr)
 {
 	int ret;
 	trace_rdev_remain_on_channel(&rdev->wiphy, wdev, chan, duration,
 				     rx_addr);
 	ret = rdev->ops->remain_on_channel(&rdev->wiphy, wdev, chan,
 					   duration, cookie, rx_addr);
-	trace_rdev_return_int_cookie(&rdev->wiphy, ret, *cookie);
+	trace_rdev_return_int_cookie(&rdev->wiphy, ret, cookie);
 	return ret;
 }
 
@@ -761,12 +761,12 @@ rdev_cancel_remain_on_channel(struct cfg80211_registered_device *rdev,
 static inline int rdev_mgmt_tx(struct cfg80211_registered_device *rdev,
 			       struct wireless_dev *wdev,
 			       struct cfg80211_mgmt_tx_params *params,
-			       u64 *cookie)
+			       u64 cookie)
 {
 	int ret;
 	trace_rdev_mgmt_tx(&rdev->wiphy, wdev, params);
 	ret = rdev->ops->mgmt_tx(&rdev->wiphy, wdev, params, cookie);
-	trace_rdev_return_int_cookie(&rdev->wiphy, ret, *cookie);
+	trace_rdev_return_int_cookie(&rdev->wiphy, ret, cookie);
 	return ret;
 }
 
@@ -775,7 +775,7 @@ static inline int rdev_tx_control_port(struct cfg80211_registered_device *rdev,
 				       const void *buf, size_t len,
 				       const u8 *dest, __be16 proto,
 				       const bool noencrypt, int link,
-				       u64 *cookie)
+				       u64 cookie)
 {
 	int ret;
 	trace_rdev_tx_control_port(&rdev->wiphy, dev, buf, len,
@@ -783,7 +783,7 @@ static inline int rdev_tx_control_port(struct cfg80211_registered_device *rdev,
 	ret = rdev->ops->tx_control_port(&rdev->wiphy, dev, buf, len,
 					 dest, proto, noencrypt, link, cookie);
 	if (cookie)
-		trace_rdev_return_int_cookie(&rdev->wiphy, ret, *cookie);
+		trace_rdev_return_int_cookie(&rdev->wiphy, ret, cookie);
 	else
 		trace_rdev_return_int(&rdev->wiphy, ret);
 	return ret;
@@ -950,12 +950,12 @@ static inline int rdev_tdls_oper(struct cfg80211_registered_device *rdev,
 
 static inline int rdev_probe_peer(struct cfg80211_registered_device *rdev,
 				  struct net_device *dev, const u8 *peer,
-				  u64 *cookie)
+				  u64 cookie)
 {
 	int ret;
 	trace_rdev_probe_peer(&rdev->wiphy, dev, peer);
 	ret = rdev->ops->probe_peer(&rdev->wiphy, dev, peer, cookie);
-	trace_rdev_return_int_cookie(&rdev->wiphy, ret, *cookie);
+	trace_rdev_return_int_cookie(&rdev->wiphy, ret, cookie);
 	return ret;
 }

gemini-3.1-pro-preview

							input: 23709
							output: 24
							thoughts: 599

**Cookie Handling Refactor in cfg80211/mac80211**

Okay, so I'm looking at this patch and it looks like a fairly significant change to how cookies are handled in several cfg80211/mac80211 functions. Specifically, they're moving from passing a `u64 *cookie` (a pointer to a cookie) to a `u64 cookie` (passing the cookie by value) in several key functions. Functions affected include `remain_on_channel`, `mgmt_tx`, `probe_peer`, and `tx_control_port`.

The changes are quite widespread; the patch touches a bunch of drivers: ath6kl, wil6210, brcmfmac, mwifiex, wilc1000, nxpwifi, qtnfmac, rtl8723bs, and also the core `cfg80211.h`, mac80211 (cfg.c, offchannel.c, tdls.c, tx.c), and wireless core headers. The files include `core.h`, `mlme.c`, `nl80211.c`, and `rdev-ops.h`.

This is a functional change, definitely not just a cosmetic one, because it fundamentally alters how cookies are generated and passed around. The old way, the drivers or mac80211 would generate the cookie and then use the pointer to send it back. The new way? `nl80211` is now responsible for generating the cookie using `cfg80211_assign_cookie(rdev)` and then passing it by value to the drivers/mac80211.

Wait a second, let me just pause and quickly check something. `cfg80211_assign_cookie`... is that a brand new function? I should probably take a look at it to see how it works. Let's do a quick grep for `cfg80211_assign_cookie` to make sure it exists, and to understand its scope. It's important to understand how these core helper functions operate.

{
  "Expression": "cfg80211_assign_cookie"
}

{
  "Output": "net/wireless/core.h=137=cfg80211_rdev_free_wowlan(struct cfg80211_registered_device *rdev)\n--\nnet/wireless/core.h-155-\nnet/wireless/core.h:156:static inline u64 cfg80211_assign_cookie(struct cfg80211_registered_device *rdev)\nnet/wireless/core.h-157-{\n--\nnet/wireless/nl80211.c=11952=static int nl80211_start_sched_scan(struct sk_buff *skb,\n--\nnet/wireless/nl80211.c-11981-\tif (want_multi \u0026\u0026 rdev-\u003ewiphy.max_sched_scan_reqs \u003e 1)\nnet/wireless/nl80211.c:11982:\t\tsched_scan_req-\u003ereqid = cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c-11983-\n--\nnet/wireless/nl80211.c=14570=static int nl80211_remain_on_channel(struct sk_buff *skb,\n--\nnet/wireless/nl80211.c-14644-\nnet/wireless/nl80211.c:14645:\tcookie = cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c-14646-\terr = rdev_remain_on_channel(rdev, wdev, chandef.chan,\n--\nnet/wireless/nl80211.c=14764=static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)\n--\nnet/wireless/nl80211.c-14886-\tparams.chan = chandef.chan;\nnet/wireless/nl80211.c:14887:\tcookie = cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c-14888-\terr = cfg80211_mlme_mgmt_tx(rdev, wdev, \u0026params, cookie);\n--\nnet/wireless/nl80211.c=16328=static int nl80211_probe_peer(struct sk_buff *skb, struct genl_info *info)\n--\nnet/wireless/nl80211.c-16375-\nnet/wireless/nl80211.c:16376:\tcookie = cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c-16377-\terr = rdev_probe_peer(rdev, dev, addr, cookie);\n--\nnet/wireless/nl80211.c=16806=static int nl80211_nan_add_func(struct sk_buff *skb,\n--\nnet/wireless/nl80211.c-16836-\nnet/wireless/nl80211.c:16837:\tfunc-\u003ecookie = cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c-16838-\n--\nnet/wireless/nl80211.c=18536=static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)\n--\nnet/wireless/nl80211.c-18591-\nnet/wireless/nl80211.c:18592:\tcookie = dont_wait_for_ack ? 0 : cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c-18593-\terr = rdev_tx_control_port(rdev, dev, buf, len,\n--\nnet/wireless/pmsr.c=414=int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)\n--\nnet/wireless/pmsr.c-521-\t}\nnet/wireless/pmsr.c:522:\treq-\u003ecookie = cfg80211_assign_cookie(rdev);\nnet/wireless/pmsr.c-523-\treq-\u003enl_portid = info-\u003esnd_portid;\n"
}

gemini-3.1-pro-preview

							input: 25964
							output: 25
							thoughts: 342

**Wireless Stack API Change Review**

Alright, let's break this down. This patch is hitting the core of the wireless stack, specifically the `cfg80211` and `mac80211` APIs for `remain_on_channel`, `mgmt_tx`, `probe_peer`, and `tx_control_port`. That's a functional change, not just a cosmetic one, meaning it's how we handle cookies and pass them up to userspace. Definitely, fuzzing is going to be crucial here to ensure we haven't introduced any vulnerabilities or unexpected behavior changes.

The key symbols to keep an eye on are the `nl80211_*` and `ieee80211_*` variations of those functions. They're the entry points from netlink and the core mac80211 stack, respectively. We need to be especially mindful of the interactions and cookie handling between these points.

As for configuration, `CONFIG_MAC80211` and `CONFIG_CFG80211` are the obvious ones. Beyond that, while `CONFIG_NL80211_TESTMODE` might provide some useful debugging capabilities, it's not strictly required for these core nl80211 commands. Now, this is interesting...QEMU can emulate `mac80211_hwsim`. That makes testing a lot easier. So, to ensure a solid testing environment, we absolutely need `CONFIG_MAC80211_HWSIM` enabled. That will give us a controlled environment to put the patch through its paces.

{
  "Expression": "config MAC80211_HWSIM"
}

{
  "Output": "drivers/net/wireless/virtual/Kconfig:1:config MAC80211_HWSIM\ndrivers/net/wireless/virtual/Kconfig-2-\ttristate \"Simulated radio testing tool for mac80211\"\n"
}

gemini-3.1-pro-preview

							input: 26747
							output: 36
							thoughts: 31

Okay, here's my take on those thoughts, tailored for an expert audience:

**Investigating the MAC80211_HWSIM Kconfig Dependencies**

Alright, I need to get a handle on the dependencies of `MAC80211_HWSIM`. Time to dive into `drivers/net/wireless/virtual/Kconfig`. I know this is where the configuration options for this virtual hardware simulation reside. I expect to find the standard `depends on` statements in there. I'm looking for clues about other features or drivers it might be linked to. This will help me understand what features it enables and potentially what other configurations might become relevant. This is a common first step when investigating how a complex feature like `MAC80211_HWSIM` integrates with the wider kernel network stack.

{
  "File": "drivers/net/wireless/virtual/Kconfig",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\tconfig MAC80211_HWSIM\n   2:\t\ttristate \"Simulated radio testing tool for mac80211\"\n   3:\t\tdepends on MAC80211\n   4:\t\thelp\n   5:\t\t  This driver is a developer testing tool that can be used to test\n   6:\t\t  IEEE 802.11 networking stack (mac80211) functionality. This is not\n   7:\t\t  needed for normal wireless LAN usage and is only for testing. See\n   8:\t\t  Documentation/networking/mac80211_hwsim for more information on how\n   9:\t\t  to use this tool.\n  10:\t\n  11:\t\t  To compile this driver as a module, choose M here: the module will be\n  12:\t\t  called mac80211_hwsim.  If unsure, say N.\n  13:\t\n  14:\tconfig VIRT_WIFI\n  15:\t\ttristate \"Wifi wrapper for ethernet drivers\"\n  16:\t\tdepends on CFG80211\n  17:\t\thelp\n  18:\t\t  This option adds support for ethernet connections to appear as if they\n  19:\t\t  are wifi connections through a special rtnetlink device.\n  20:\t\n"
}

gemini-3.1-pro-preview

							input: 27314
							output: 27
							thoughts: 368

**My Analysis of the Wireless Patch**

Okay, so I'm looking at this patch and immediately see the dependency chain: `MAC80211_HWSIM` relies on `MAC80211`, which in turn relies on `CFG80211`. That means for this to work, I'll need to ensure all three are enabled: `CFG80211`, `MAC80211`, and `MAC80211_HWSIM`. That's the baseline.

Now, let's dig a little deeper. This patch is touching the core of `cfg80211` and `mac80211`, which makes me think it's functional. These changes are definitely accessible through `nl80211`, which is promising. The fact that the patch also touches various drivers is concerning because I can't possibly test them all in a QEMU environment. However, the use of `mac80211_hwsim` is a smart move. It should exercise the `mac80211` and `cfg80211` paths, which are the primary focus of this.

To make sure I'm following everything, I need to focus on these symbols: `nl80211_remain_on_channel`, `nl80211_tx_mgmt`, `nl80211_probe_peer`, `nl80211_tx_control_port`, `cfg80211_mlme_mgmt_tx`, `ieee80211_remain_on_channel`, `ieee80211_mgmt_tx`, `ieee80211_probe_peer`, and `ieee80211_tx_control_port`. I need to be sure that these functions and the names are correct. I'll need to go back and verify `ieee80211_tx_control_port`.

{
  "Expression": "ieee80211_tx_control_port"
}

{
  "Output": "net/mac80211/cfg.c=5974=const struct cfg80211_ops mac80211_config_ops = {\n--\nnet/mac80211/cfg.c-6068-\t.set_multicast_to_unicast = ieee80211_set_multicast_to_unicast,\nnet/mac80211/cfg.c:6069:\t.tx_control_port = ieee80211_tx_control_port,\nnet/mac80211/cfg.c-6070-\t.get_txq_stats = ieee80211_get_txq_stats,\n--\nnet/mac80211/ieee80211_i.h=2247=void ieee80211_clear_fast_xmit(struct sta_info *sta);\nnet/mac80211/ieee80211_i.h:2248:int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,\nnet/mac80211/ieee80211_i.h-2249-\t\t\t      const u8 *buf, size_t len,\n--\nnet/mac80211/tx.c=2651=static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/tx.c-3050-\t\t * ctrl_flags already have been set by\nnet/mac80211/tx.c:3051:\t\t * ieee80211_tx_control_port(), here\nnet/mac80211/tx.c-3052-\t\t * we just sanity check that\n--\nnet/mac80211/tx.c=6497=void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/tx.c-6527-\nnet/mac80211/tx.c:6528:int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,\nnet/mac80211/tx.c-6529-\t\t\t      const u8 *buf, size_t len,\n"
}

gemini-3.1-pro-preview

							input: 28789
							output: 25
							thoughts: 24

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Confirming and Refining a Hypothesis**

Okay, so the initial assessment feels correct. *Yes, it is*. But, let's not rush to conclusions. I need to be absolutely certain before proceeding. This is critical.

To be thorough, let's immediately and specifically go back and rigorously examine the implementation of `ieee80211_probe_peer`. I want to drill down into the core function that's at the heart of the matter. Double-checking is crucial here. I need to refresh my memory of the exact logic within that probe function. I'm going to look at the edge cases, and all possible sources of error. No stone unturned.

{
  "Expression": "ieee80211_probe_peer"
}

{
  "Output": "net/mac80211/cfg.c=4927=static int ieee80211_set_rekey_data(struct wiphy *wiphy,\n--\nnet/mac80211/cfg.c-4941-\nnet/mac80211/cfg.c:4942:static int ieee80211_probe_peer(struct wiphy *wiphy, struct net_device *dev,\nnet/mac80211/cfg.c-4943-\t\t\t\tconst u8 *peer, u64 cookie)\n--\nnet/mac80211/cfg.c=5974=const struct cfg80211_ops mac80211_config_ops = {\n--\nnet/mac80211/cfg.c-6049-\t.tdls_cancel_channel_switch = ieee80211_tdls_cancel_channel_switch,\nnet/mac80211/cfg.c:6050:\t.probe_peer = ieee80211_probe_peer,\nnet/mac80211/cfg.c-6051-\t.set_noack_map = ieee80211_set_noack_map,\n"
}

gemini-3.1-pro-preview

							input: 29326
							output: 25
							thoughts: 24

Okay, here's my take on those thoughts, tailored for an expert audience:

**Confirming and Cross-Referencing**

Yes, that's correct, no surprises there. My initial assessment is holding. But, just to be absolutely certain, and to solidify my understanding, let me quickly double-check the `ieee80211_mgmt_tx` function. I want to quickly refresh my understanding of how this particular mechanism handles the transaction. No need to leave any stone unturned when dealing with low level systems. I need to refresh the inner workings of this function in my mind to proceed with the next step.

{
  "Expression": "ieee80211_mgmt_tx"
}

{
  "Output": "net/mac80211/cfg.c=5974=const struct cfg80211_ops mac80211_config_ops = {\n--\nnet/mac80211/cfg.c-6036-\t.cancel_remain_on_channel = ieee80211_cancel_remain_on_channel,\nnet/mac80211/cfg.c:6037:\t.mgmt_tx = ieee80211_mgmt_tx,\nnet/mac80211/cfg.c:6038:\t.mgmt_tx_cancel_wait = ieee80211_mgmt_tx_cancel_wait,\nnet/mac80211/cfg.c-6039-\t.set_cqm_rssi_config = ieee80211_set_cqm_rssi_config,\n--\nnet/mac80211/ieee80211_i.h=2155=int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,\nnet/mac80211/ieee80211_i.h-2156-\t\t\t\t       struct wireless_dev *wdev, u64 cookie);\nnet/mac80211/ieee80211_i.h:2157:int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\nnet/mac80211/ieee80211_i.h-2158-\t\t      struct cfg80211_mgmt_tx_params *params, u64 cookie);\nnet/mac80211/ieee80211_i.h:2159:int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,\nnet/mac80211/ieee80211_i.h-2160-\t\t\t\t  struct wireless_dev *wdev, u64 cookie);\n--\nnet/mac80211/offchannel.c=801=int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,\n--\nnet/mac80211/offchannel.c-809-\nnet/mac80211/offchannel.c:810:int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\nnet/mac80211/offchannel.c-811-\t\t      struct cfg80211_mgmt_tx_params *params, u64 cookie)\n--\nnet/mac80211/offchannel.c-1045-\nnet/mac80211/offchannel.c:1046:int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,\nnet/mac80211/offchannel.c-1047-\t\t\t\t  struct wireless_dev *wdev, u64 cookie)\n"
}

gemini-3.1-pro-preview

							input: 30288
							output: 27
							thoughts: 26

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Double-Checking the `ieee80211_remain_on_channel` Function**

Okay, yes, that seems right. But before I move on, I need to be absolutely certain. Let me just quickly run through the details again. I'm going to double-check the implementation of `ieee80211_remain_on_channel`. It's a critical function, and a subtle bug here could have cascading and nasty implications down the line. It's too important to gloss over, even if my initial assessment suggested everything was in order. I'm going to make sure I'm solid on the nuances and any potential edge cases before I finalize my conclusions.

{
  "Expression": "ieee80211_remain_on_channel"
}

{
  "Output": "drivers/net/wireless/ath/ath10k/mac.c=4521=void __ath10k_scan_finish(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/mac.c-4530-\t\tif (ar-\u003escan.is_roc \u0026\u0026 ar-\u003escan.roc_notify)\ndrivers/net/wireless/ath/ath10k/mac.c:4531:\t\t\tieee80211_remain_on_channel_expired(ar-\u003ehw);\ndrivers/net/wireless/ath/ath10k/mac.c-4532-\t\tfallthrough;\n--\ndrivers/net/wireless/ath/ath11k/mac.c=3866=void __ath11k_mac_scan_finish(struct ath11k *ar)\n--\ndrivers/net/wireless/ath/ath11k/mac.c-3875-\t\tif (ar-\u003escan.is_roc \u0026\u0026 ar-\u003escan.roc_notify)\ndrivers/net/wireless/ath/ath11k/mac.c:3876:\t\t\tieee80211_remain_on_channel_expired(ar-\u003ehw);\ndrivers/net/wireless/ath/ath11k/mac.c-3877-\t\tfallthrough;\n--\ndrivers/net/wireless/ath/ath12k/mac.c=5161=void __ath12k_mac_scan_finish(struct ath12k *ar)\n--\ndrivers/net/wireless/ath/ath12k/mac.c-5172-\t\tif (ar-\u003escan.is_roc \u0026\u0026 ar-\u003escan.roc_notify)\ndrivers/net/wireless/ath/ath12k/mac.c:5173:\t\t\tieee80211_remain_on_channel_expired(hw);\ndrivers/net/wireless/ath/ath12k/mac.c-5174-\t\tfallthrough;\n--\ndrivers/net/wireless/ath/ath9k/channel.c=934=void ath_roc_complete(struct ath_softc *sc, enum ath_roc_complete_reason reason)\n--\ndrivers/net/wireless/ath/ath9k/channel.c-943-\t\tath_dbg(common, CHAN_CTX, \"RoC aborted\\n\");\ndrivers/net/wireless/ath/ath9k/channel.c:944:\t\tieee80211_remain_on_channel_expired(sc-\u003ehw);\ndrivers/net/wireless/ath/ath9k/channel.c-945-\t\tbreak;\n--\ndrivers/net/wireless/ath/ath9k/channel.c-947-\t\tath_dbg(common, CHAN_CTX, \"RoC expired\\n\");\ndrivers/net/wireless/ath/ath9k/channel.c:948:\t\tieee80211_remain_on_channel_expired(sc-\u003ehw);\ndrivers/net/wireless/ath/ath9k/channel.c-949-\t\tbreak;\n--\ndrivers/net/wireless/intel/iwlwifi/mld/iface.c=20=void iwl_mld_cleanup_vif(void *data, u8 *mac, struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/intel/iwlwifi/mld/iface.c-34-\tif (mld_vif-\u003eroc_activity != ROC_NUM_ACTIVITIES)\ndrivers/net/wireless/intel/iwlwifi/mld/iface.c:35:\t\tieee80211_remain_on_channel_expired(mld-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mld/iface.c-36-\n--\ndrivers/net/wireless/intel/iwlwifi/mld/roc.c=225=void iwl_mld_handle_roc_notif(struct iwl_mld *mld,\n--\ndrivers/net/wireless/intel/iwlwifi/mld/roc.c-258-\t\t */\ndrivers/net/wireless/intel/iwlwifi/mld/roc.c:259:\t\tieee80211_remain_on_channel_expired(mld-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mld/roc.c-260-\t}\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/mac80211.c=1130=void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/mac80211.c-1141-\tiwl_mvm_cleanup_roc_te(mvm);\ndrivers/net/wireless/intel/iwlwifi/mvm/mac80211.c:1142:\tieee80211_remain_on_channel_expired(mvm-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mvm/mac80211.c-1143-\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c=309=static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-351-\t\tcase NL80211_IFTYPE_P2P_DEVICE:\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c:352:\t\t\tieee80211_remain_on_channel_expired(mvm-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-353-\t\t\tiwl_mvm_roc_finished(mvm);\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c=415=void iwl_mvm_rx_roc_notif(struct iwl_mvm *mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-444-\t\tiwl_mvm_roc_finished(mvm);\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c:445:\t\tieee80211_remain_on_channel_expired(mvm-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-446-\t}\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c=452=static int iwl_mvm_aux_roc_te_handle_notif(struct iwl_mvm *mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-475-\t\t/* End TE, notify mac80211 */\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c:476:\t\tieee80211_remain_on_channel_expired(mvm-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-477-\t\tiwl_mvm_roc_finished(mvm); /* flush aux queue */\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c=945=void iwl_mvm_rx_session_protect_notif(struct iwl_mvm *mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-1009-\t\tiwl_mvm_roc_finished(mvm);\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c:1010:\t\tieee80211_remain_on_channel_expired(mvm-\u003ehw);\ndrivers/net/wireless/intel/iwlwifi/mvm/time-event.c-1011-\t} else if (le32_to_cpu(notif-\u003estart)) {\n--\ndrivers/net/wireless/mediatek/mt76/channel.c=313=void mt76_roc_complete(struct mt76_phy *phy)\n--\ndrivers/net/wireless/mediatek/mt76/channel.c-331-\tif (!test_bit(MT76_MCU_RESET, \u0026dev-\u003ephy.state))\ndrivers/net/wireless/mediatek/mt76/channel.c:332:\t\tieee80211_remain_on_channel_expired(phy-\u003ehw);\ndrivers/net/wireless/mediatek/mt76/channel.c-333-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c=1030=void mt7615_roc_work(struct work_struct *work)\n--\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c-1044-\tmt7615_mutex_release(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c:1045:\tieee80211_remain_on_channel_expired(phy-\u003emt76-\u003ehw);\ndrivers/net/wireless/mediatek/mt76/mt7615/main.c-1046-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c=387=void mt7921_roc_work(struct work_struct *work)\n--\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-402-\tmt792x_mutex_release(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c:403:\tieee80211_remain_on_channel_expired(phy-\u003emt76-\u003ehw);\ndrivers/net/wireless/mediatek/mt76/mt7921/main.c-404-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c=509=void mt7925_roc_work(struct work_struct *work)\n--\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-523-\tmt792x_mutex_release(phy-\u003edev);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c:524:\tieee80211_remain_on_channel_expired(phy-\u003emt76-\u003ehw);\ndrivers/net/wireless/mediatek/mt76/mt7925/main.c-525-}\n--\ndrivers/net/wireless/realtek/rtw89/core.c=5048=void rtw89_roc_end(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-5057-\ndrivers/net/wireless/realtek/rtw89/core.c:5058:\tieee80211_remain_on_channel_expired(hw);\ndrivers/net/wireless/realtek/rtw89/core.c-5059-\n--\ndrivers/net/wireless/rsi/rsi_91x_mac80211.c=1769=void rsi_roc_timeout(struct timer_list *t)\n--\ndrivers/net/wireless/rsi/rsi_91x_mac80211.c-1775-\tmutex_lock(\u0026common-\u003emutex);\ndrivers/net/wireless/rsi/rsi_91x_mac80211.c:1776:\tieee80211_remain_on_channel_expired(common-\u003epriv-\u003ehw);\ndrivers/net/wireless/rsi/rsi_91x_mac80211.c-1777-\n--\ndrivers/net/wireless/silabs/wfx/scan.c=149=void wfx_remain_on_channel_work(struct work_struct *work)\n--\ndrivers/net/wireless/silabs/wfx/scan.c-178-\t\tdev_err(wvif-\u003ewdev-\u003edev, \"roc didn't stop\\n\");\ndrivers/net/wireless/silabs/wfx/scan.c:179:\tieee80211_remain_on_channel_expired(wvif-\u003ewdev-\u003ehw);\ndrivers/net/wireless/silabs/wfx/scan.c-180-end:\n--\ndrivers/net/wireless/ti/wlcore/main.c=2712=static void __wl1271_op_remove_interface(struct wl1271 *wl,\n--\ndrivers/net/wireless/ti/wlcore/main.c-2754-\t\twl-\u003eroc_vif = NULL;\ndrivers/net/wireless/ti/wlcore/main.c:2755:\t\tieee80211_remain_on_channel_expired(wl-\u003ehw);\ndrivers/net/wireless/ti/wlcore/main.c-2756-\t}\n--\ndrivers/net/wireless/ti/wlcore/main.c=5743=static void wlcore_roc_complete_work(struct work_struct *work)\n--\ndrivers/net/wireless/ti/wlcore/main.c-5753-\tif (!ret)\ndrivers/net/wireless/ti/wlcore/main.c:5754:\t\tieee80211_remain_on_channel_expired(wl-\u003ehw);\ndrivers/net/wireless/ti/wlcore/main.c-5755-}\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=3307=static void hw_roc_done(struct work_struct *work)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3312-\tmutex_lock(\u0026hwsim-\u003emutex);\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:3313:\tieee80211_remain_on_channel_expired(hwsim-\u003ehw);\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3314-\thwsim-\u003etmp_chan = NULL;\n--\ninclude/net/mac80211.h=4068=struct ieee80211_prep_tx_info {\n--\ninclude/net/mac80211.h-4451- *\tduration (which will always be non-zero) expires, the driver must call\ninclude/net/mac80211.h:4452: *\tieee80211_remain_on_channel_expired().\ninclude/net/mac80211.h-4453- *\tNote that this callback may be called while the device is in IDLE and\n--\ninclude/net/mac80211.h=7168=void ieee80211_ready_on_channel(struct ieee80211_hw *hw);\n--\ninclude/net/mac80211.h-7170-/**\ninclude/net/mac80211.h:7171: * ieee80211_remain_on_channel_expired - remain_on_channel duration expired\ninclude/net/mac80211.h-7172- * @hw: pointer as obtained from ieee80211_alloc_hw()\ninclude/net/mac80211.h-7173- */\ninclude/net/mac80211.h:7174:void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw);\ninclude/net/mac80211.h-7175-\n--\nnet/mac80211/cfg.c=5974=const struct cfg80211_ops mac80211_config_ops = {\n--\nnet/mac80211/cfg.c-6034-\t.set_bitrate_mask = ieee80211_set_bitrate_mask,\nnet/mac80211/cfg.c:6035:\t.remain_on_channel = ieee80211_remain_on_channel,\nnet/mac80211/cfg.c-6036-\t.cancel_remain_on_channel = ieee80211_cancel_remain_on_channel,\n--\nnet/mac80211/ieee80211_i.h=2149=void ieee80211_roc_purge(struct ieee80211_local *local,\nnet/mac80211/ieee80211_i.h-2150-\t\t\t struct ieee80211_sub_if_data *sdata);\nnet/mac80211/ieee80211_i.h:2151:int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,\nnet/mac80211/ieee80211_i.h-2152-\t\t\t\tstruct ieee80211_channel *chan,\n--\nnet/mac80211/offchannel.c=496=static void ieee80211_hw_roc_done(struct wiphy *wiphy, struct wiphy_work *work)\n--\nnet/mac80211/offchannel.c-508-\nnet/mac80211/offchannel.c:509:void ieee80211_remain_on_channel_expired(struct ieee80211_hw *hw)\nnet/mac80211/offchannel.c-510-{\n--\nnet/mac80211/offchannel.c-516-}\nnet/mac80211/offchannel.c:517:EXPORT_SYMBOL_GPL(ieee80211_remain_on_channel_expired);\nnet/mac80211/offchannel.c-518-\n--\nnet/mac80211/offchannel.c=559=static int ieee80211_start_roc_work(struct ieee80211_local *local,\n--\nnet/mac80211/offchannel.c-702-\nnet/mac80211/offchannel.c:703:int ieee80211_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,\nnet/mac80211/offchannel.c-704-\t\t\t\tstruct ieee80211_channel *chan,\n"
}

gemini-3.1-pro-preview

							input: 35253
							output: 27
							thoughts: 39

Okay, here's my interpretation of those thoughts, framed as an expert's internal monologue:

**Checking the Stay-on-Channel Mechanism**

Alright, the core function in question here is clearly `ieee80211_remain_on_channel`. That's the one I need to focus on. My mental checklist kicks in automatically; the stay-on-channel mechanism is usually tightly coupled with management frame transmission.

So, let me immediately cross-reference that with the relevant management frame transmission function. I'm going to quickly verify how `cfg80211_mlme_mgmt_tx` interacts with `ieee80211_remain_on_channel`. I need to ensure the proper interaction between these components. Is there a call directly from the former to the latter, or is it a more indirect interaction through other functions? Are there any data structures or flags shared to guarantee that stay-on-channel is respected when a management frame is transmitted? I need to understand the sequencing and the conditions under which the stay-on-channel process is initiated, handled, and finally, terminated in relation to frame transmission.

{
  "Expression": "cfg80211_mlme_mgmt_tx"
}

{
  "Output": "net/wireless/core.h=401=void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev);\nnet/wireless/core.h:402:int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,\nnet/wireless/core.h-403-\t\t\t  struct wireless_dev *wdev,\n--\nnet/wireless/mlme.c=862=static bool cfg80211_allowed_random_address(struct wireless_dev *wdev,\n--\nnet/wireless/mlme.c-894-\nnet/wireless/mlme.c:895:int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,\nnet/wireless/mlme.c-896-\t\t\t  struct wireless_dev *wdev,\n--\nnet/wireless/nl80211.c=14764=static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)\n--\nnet/wireless/nl80211.c-14887-\tcookie = cfg80211_assign_cookie(rdev);\nnet/wireless/nl80211.c:14888:\terr = cfg80211_mlme_mgmt_tx(rdev, wdev, \u0026params, cookie);\nnet/wireless/nl80211.c-14889-\tif (err)\n"
}

gemini-3.1-pro-preview

							input: 35962
							output: 26
							thoughts: 24

Okay, here's my summary, tailored for an expert audience, as if it's a direct stream of thought:

**Checking the Remain on Channel Functionality**

Yes, that's correct. I'm confirming that what I'm thinking is the case. Alright, now, the next logical step is to check the `nl80211_remain_on_channel` function itself. I need to get a clear picture of how this piece of code operates. Understanding its specifics is crucial for confirming my hypothesis. Let's see what's what.

{
  "Expression": "nl80211_remain_on_channel"
}

{
  "Output": "net/wireless/nl80211.c=14549=static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)\n--\nnet/wireless/nl80211.c-14569-\nnet/wireless/nl80211.c:14570:static int nl80211_remain_on_channel(struct sk_buff *skb,\nnet/wireless/nl80211.c-14571-\t\t\t\t     struct genl_info *info)\n--\nnet/wireless/nl80211.c=19733=static const struct genl_small_ops nl80211_small_ops[] = {\n--\nnet/wireless/nl80211.c-20089-\t\t.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,\nnet/wireless/nl80211.c:20090:\t\t.doit = nl80211_remain_on_channel,\nnet/wireless/nl80211.c-20091-\t\t.flags = GENL_UNS_ADMIN_PERM,\n"
}

gemini-3.1-pro-preview

							input: 36455
							output: 24
							thoughts: 22

Okay, here's my take on those thoughts, tailored for an expert audience:

**Confirming and Zeroing In**

Yes, that's exactly right, that's what I was thinking. Now, the next logical step is to dive right into the `nl80211_tx_mgmt` function. I need to refresh my understanding of how that module handles the transmission of management frames within the nl80211 framework. I have a feeling there might be a subtle nuance there that I've overlooked. Time to get down to brass tacks and double-check those parameters and the associated logic. I'm especially keen to see how it manages the frame construction and any potential rate control considerations. Let's see what's what.

{
  "Expression": "nl80211_tx_mgmt"
}

{
  "Output": "net/wireless/nl80211.c=14706=static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)\n--\nnet/wireless/nl80211.c-14763-\nnet/wireless/nl80211.c:14764:static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)\nnet/wireless/nl80211.c-14765-{\n--\nnet/wireless/nl80211.c-14909-\nnet/wireless/nl80211.c:14910:static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)\nnet/wireless/nl80211.c-14911-{\n--\nnet/wireless/nl80211.c=19733=static const struct genl_small_ops nl80211_small_ops[] = {\n--\nnet/wireless/nl80211.c-20120-\t\t.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,\nnet/wireless/nl80211.c:20121:\t\t.doit = nl80211_tx_mgmt,\nnet/wireless/nl80211.c-20122-\t\t.flags = GENL_UNS_ADMIN_PERM,\n--\nnet/wireless/nl80211.c-20127-\t\t.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,\nnet/wireless/nl80211.c:20128:\t\t.doit = nl80211_tx_mgmt_cancel_wait,\nnet/wireless/nl80211.c-20129-\t\t.flags = GENL_UNS_ADMIN_PERM,\n"
}

gemini-3.1-pro-preview

							input: 37195
							output: 24
							thoughts: 22

Okay, here's my take on those thoughts, tailored for an expert audience:

**Confirming and Zeroing In**

Yes, that's definitely the key point we're dealing with. Okay, so the next thing to investigate is `nl80211_probe_peer`. That's where I need to focus my attention. It's the logical next step in tracing this issue.

{
  "Expression": "nl80211_probe_peer"
}

{
  "Output": "net/wireless/nl80211.c=16310=static int nl80211_register_unexpected_frame(struct sk_buff *skb,\n--\nnet/wireless/nl80211.c-16327-\nnet/wireless/nl80211.c:16328:static int nl80211_probe_peer(struct sk_buff *skb, struct genl_info *info)\nnet/wireless/nl80211.c-16329-{\n--\nnet/wireless/nl80211.c=19733=static const struct genl_small_ops nl80211_small_ops[] = {\n--\nnet/wireless/nl80211.c-20237-\t\t.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,\nnet/wireless/nl80211.c:20238:\t\t.doit = nl80211_probe_peer,\nnet/wireless/nl80211.c-20239-\t\t.flags = GENL_UNS_ADMIN_PERM,\n"
}

gemini-3.1-pro-preview

							input: 37637
							output: 26
							thoughts: 24

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing the Transmission Control Port**

Yes, that's definitely the key area to be looking at. I'm focusing in on `nl80211_tx_control_port`. It's where the rubber meets the road, so to speak, in terms of actually *controlling* the transmission process for 802.11 frames. Gotta verify the nuances there.

{
  "Expression": "nl80211_tx_control_port"
}

{
  "Output": "net/wireless/nl80211.c=18494=static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)\n--\nnet/wireless/nl80211.c-18535-\nnet/wireless/nl80211.c:18536:static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)\nnet/wireless/nl80211.c-18537-{\n--\nnet/wireless/nl80211.c=19733=static const struct genl_small_ops nl80211_small_ops[] = {\n--\nnet/wireless/nl80211.c-20471-\t\t.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,\nnet/wireless/nl80211.c:20472:\t\t.doit = nl80211_tx_control_port,\nnet/wireless/nl80211.c-20473-\t\t.flags = GENL_UNS_ADMIN_PERM,\n"
}

gemini-3.1-pro-preview

							input: 38107
							output: 331
							thoughts: 438

**Fuzzing Plan for This Patch**

Okay, yes, this patch looks solid, definitely functional, and ready for a good fuzzing run. My initial assessment is that it needs to be stressed with fuzzing.

To ensure comprehensive coverage, I'll need to configure the fuzzing environment with `CFG80211`, `MAC80211`, and `MAC80211_HWSIM`. That will be my starting point.

The core focus symbols for initial fuzzing are:
-   `nl80211_remain_on_channel`
-   `nl80211_tx_mgmt`
-   `nl80211_probe_peer`
-   `nl80211_tx_control_port`
-   `cfg80211_mlme_mgmt_tx`
-   `ieee80211_remain_on_channel`
-   `ieee80211_mgmt_tx`
-   `ieee80211_probe_peer`
-   `ieee80211_tx_control_port`

However, a quick scan of the modified functions reveals several additional areas impacted. I see `ieee80211_attach_ack_skb` which looks interesting for fuzzing, as well as `ieee80211_start_roc_work`, which could also expose some vulnerabilities. I'm also seeing `ieee80211_mlo_multicast_tx_one`, `ieee80211_mlo_multicast_tx`, `ieee80211_subif_start_xmit`, `ieee80211_8023_xmit`, `ieee80211_build_data_template`, `ieee80211_probe_mesh_link`, and `ieee80211_tdls_prep_mgmt_packet`.

Considering these, I'm going to add `ieee80211_attach_ack_skb` and `ieee80211_start_roc_work` to the initial focus list for fuzzing. This should give a robust test, and hopefully unearth any hidden bugs.

{
  "EnableConfigs": [
    "CFG80211",
    "MAC80211",
    "MAC80211_HWSIM"
  ],
  "FocusSymbols": [
    "nl80211_remain_on_channel",
    "nl80211_tx_mgmt",
    "nl80211_probe_peer",
    "nl80211_tx_control_port",
    "cfg80211_mlme_mgmt_tx",
    "ieee80211_remain_on_channel",
    "ieee80211_mgmt_tx",
    "ieee80211_probe_peer",
    "ieee80211_tx_control_port",
    "ieee80211_attach_ack_skb",
    "ieee80211_start_roc_work"
  ],
  "Reasoning": "The patch changes how cookies are generated and passed for several nl80211 commands (remain_on_channel, tx_mgmt, probe_peer, tx_control_port). It modifies the core cfg80211 and mac80211 logic to generate cookies in nl80211 and pass them by value to drivers, instead of having drivers generate them and pass them back via pointers. This is a functional change to the core wireless stack and should be fuzzed.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "CFG80211",
    "MAC80211",
    "MAC80211_HWSIM"
  ],
  "FocusSymbols": [
    "nl80211_remain_on_channel",
    "nl80211_tx_mgmt",
    "nl80211_probe_peer",
    "nl80211_tx_control_port",
    "cfg80211_mlme_mgmt_tx",
    "ieee80211_remain_on_channel",
    "ieee80211_mgmt_tx",
    "ieee80211_probe_peer",
    "ieee80211_tx_control_port",
    "ieee80211_attach_ack_skb",
    "ieee80211_start_roc_work"
  ],
  "Reasoning": "The patch changes how cookies are generated and passed for several nl80211 commands (remain_on_channel, tx_mgmt, probe_peer, tx_control_port). It modifies the core cfg80211 and mac80211 logic to generate cookies in nl80211 and pass them by value to drivers, instead of having drivers generate them and pass them back via pointers. This is a functional change to the core wireless stack and should be fuzzed.",
  "WorthFuzzing": true
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)