HI, It appears, action frame processing as 2 different flows for pmf and non-pmf cases. for pmf case "hostapd_action_rx() " comes into active path and it as below bug ------------ bug ----- hostapd_action_rx() plen = drv_mgmt->frame_len - 24 - 1; const u8 *payload = drv_mgmt->frame + 24 + 1; ---- points to "action_code + ..." wpa_ft_action_rx() ----- it expects contents "categor+action_code+..." ------------- --------- fix ------- hostapd_action_rx() plen = drv_mgmt->frame_len - IEEE80211_HDRLEN; const u8 *payload = (u8 *)&mgmt->u.action; wpa_ft_action_rx() --------- fix ------- I think it is applicable to hostapd-2.7 as well. If so, can someone post the patch . Thanks, -Praveen _______________________________________________ Hostap mailing list Hostap@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/hostap
