wifi: mac80211: use ap_addr for 4-address NULL frame destination

Currently ieee80211_send_4addr_nullfunc() uses deflink.u.mgd.bssid
for addr1 and addr3 fields. In MLO configurations, deflink.u.mgd.bssid
represents link 0's BSSID and is not updated when link 0 is not an
assoc link. This causes 4-address NULL frames to be sent to the
wrong address, preventing WDS AP_VLAN interface creation on the peer AP.

To fix this use sdata->vif.cfg.ap_addr instead, which contains the AP's MLD
address populated during authentication/association and remains
valid regardless of which links are active.

This ensures 4-address NULL frames reach the correct AP, allowing
proper WDS operation over MLO connections.

Co-developed-by: Sathishkumar Muruganandam <quic_murugana@quicinc.com>
Signed-off-by: Sathishkumar Muruganandam <quic_murugana@quicinc.com>
Signed-off-by: Tamizh Chelvam Raja <tamizh.raja@oss.qualcomm.com>
Link: https://patch.msgid.link/20260326164723.553927-3-tamizh.raja@oss.qualcomm.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 285caaa2997e2beabebb35c8b67244a369626f72..4a34547b39d59f926d63b9ab9844b5ea556b3a6f 100644 (file)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2514,9 +2514,9 @@ void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
                         IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
        nullfunc->frame_control = fc;
-       memcpy(nullfunc->addr1, sdata->deflink.u.mgd.bssid, ETH_ALEN);
+       memcpy(nullfunc->addr1, sdata->vif.cfg.ap_addr, ETH_ALEN);
        memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
-       memcpy(nullfunc->addr3, sdata->deflink.u.mgd.bssid, ETH_ALEN);
+       memcpy(nullfunc->addr3, sdata->vif.cfg.ap_addr, ETH_ALEN);
        memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
 
        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;