From 31b726adbd2678446aa9588abe9f19d71ce0c2f4 Mon Sep 17 00:00:00 2001 From: Shen Mintao Date: Thu, 10 Sep 2026 11:26:07 +0800 Subject: [PATCH] fix: correct TDLS discovery response length on Linux 7.1+ Linux 7.1 moved action_code outside tdls_discover_resp. Reserve both category and action_code bytes before the response body so appending an IE does not overwrite the capability field. Sync the USB hunk from radxa-pkg/aic8800 commit bd01abe95bc83c4708dd1d117e27424ee41cc747. Validation: Linux 6.14, 6.17 and 7.2 module builds succeeded. A focused frame construction check detects the original one-byte overwrite and passes with this change. Hardware TDLS operation remains untested. --- drivers/aic8800/aic8800_fdrv/rwnx_tdls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/aic8800/aic8800_fdrv/rwnx_tdls.c b/drivers/aic8800/aic8800_fdrv/rwnx_tdls.c index 5def8b7..1759b84 100644 --- a/drivers/aic8800/aic8800_fdrv/rwnx_tdls.c +++ b/drivers/aic8800/aic8800_fdrv/rwnx_tdls.c @@ -116,7 +116,7 @@ rwnx_prep_tdls_direct(struct rwnx_hw *rwnx_hw, struct rwnx_vif *rwnx_vif, switch (action_code) { case WLAN_PUB_ACTION_TDLS_DISCOVER_RES: #if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0) - skb_put(skb, 1 + sizeof(mgmt->u.action.tdls_discover_resp)); + skb_put(skb, 2 + sizeof(mgmt->u.action.tdls_discover_resp)); mgmt->u.action.category = WLAN_CATEGORY_PUBLIC; mgmt->u.action.action_code = WLAN_PUB_ACTION_TDLS_DISCOVER_RES; mgmt->u.action.tdls_discover_resp.dialog_token = dialog_token;