From f3d29dc9224b0881d10d34664456adf113bc4777 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Mon, 5 Oct 2026 22:47:52 +0200 Subject: [PATCH] wifi: mac80211: clear fragment cache entry 'is_protected' In practice, we probably shouldn't end up with a fragmented frame that's protected, filled into the cache, finished or dropped and then the next frame is unprotected, since only unicast data frames can be fragmented. However, tools complain and it's more correct to be able to do this (e.g. an unencrypted fragmented EAPOL _could_, at least in theory, happen), so clear the flag when the entry is reused. Assisted-by: LLM Fixes: 7e44a0b597f0 ("mac80211: prevent attacks on TKIP/WEP as well") Link: https://patch.msgid.link/20261005224950.c3e4106f34d5.I866c0862db031c3a810d2333acdd22e2733d2b8c@changeid Signed-off-by: Johannes Berg --- net/mac80211/rx.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index b06301c1e88b..ecee9348c70d 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -2284,6 +2284,7 @@ ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache, entry->rx_queue = rx_queue; entry->last_frag = frag; entry->check_sequential_pn = false; + entry->is_protected = false; entry->extra_len = 0; return entry;