From: Bogdan Nicolae <bogdan.nicolae@acm.org>

Avoid setting packet_id to cookie, which is always 0. Instead, use an
increasing atomic counter. Avoids mismatches of completion events later
in brcmf_notify_mgmt_tx_status, where packet_id != vif->mgmt_tx_id is
checked.

Also, zero out auth_status on initialization. Otherwise, garbage will
leak from the stack to the firmware (when ssid is less than 32 bytes
and/or when params->pmkid is set). Then, pass the params->pmkid to the
firmware (without it, the firmware caches a garbage PMKID on successful
authentication and denies a subsequent association request that includes
the PMKID).

Signed-off-by: Bogdan Nicolae <bogdan.nicolae@acm.org>
---
 .../net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c   | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
index ce09d44fa..99f8c5bef 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c
@@ -23,6 +23,8 @@
 #define MGMT_AUTH_FRAME_DWELL_TIME	4000
 #define MGMT_AUTH_FRAME_WAIT_TIME	(MGMT_AUTH_FRAME_DWELL_TIME + 100)
 
+static atomic_t brcmf_cyw_mgmt_tx_id = ATOMIC_INIT(0);
+
 static int brcmf_cyw_set_sae_pwd(struct brcmf_if *ifp,
 				 struct cfg80211_crypto_settings *crypto)
 {
@@ -123,7 +125,7 @@ int brcmf_cyw_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 	if (!ieee80211_is_auth(mgmt->frame_control))
 		return brcmf_cfg80211_mgmt_tx(wiphy, wdev, params, cookie);
 
-	*cookie = 0;
+	*cookie = atomic_inc_return(&brcmf_cyw_mgmt_tx_id);
 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 
 	reinit_completion(&vif->mgmt_tx);
@@ -200,7 +202,7 @@ brcmf_cyw_external_auth(struct wiphy *wiphy, struct net_device *dev,
 {
 	struct brcmf_if *ifp;
 	struct brcmf_pub *drvr;
-	struct brcmf_auth_req_status_le auth_status;
+	struct brcmf_auth_req_status_le auth_status = {};
 	int ret = 0;
 
 	brcmf_dbg(TRACE, "Enter\n");
@@ -208,6 +210,8 @@ brcmf_cyw_external_auth(struct wiphy *wiphy, struct net_device *dev,
 	ifp = netdev_priv(dev);
 	drvr = ifp->drvr;
 	if (params->status == WLAN_STATUS_SUCCESS) {
+		if (params->pmkid)
+			memcpy(auth_status.pmkid, params->pmkid, WLAN_PMKID_LEN);
 		auth_status.flags = cpu_to_le16(BRCMF_EXTAUTH_SUCCESS);
 	} else {
 		bphy_err(drvr, "External authentication failed: status=%d\n",
-- 
2.55.0

On Tue, 14 Jul 2026, bogdan.nicolae@gmail.com wrote:

> [PATCH] wifi: brcmfmac: cyw: clean up PMKID and cookie code

The code itself is correct, but there are process issues that need to be
fixed before I can accept this:

1. This is a resubmission of the patch sent on 2026-07-09 [1]. A
   resubmission must carry a version tag: the subject line should read
   "[PATCH v2] wifi: brcmfmac: ..." not "[PATCH] wifi: brcmfmac: ...".

2. A v2 submission must include a "Changes in v2:" section below the ---
   line documenting what changed from v1.

3. The From: address (bogdan.nicolae@gmail.com) does not match the
   Signed-off-by address (bogdan.nicolae@acm.org). Please use a
   consistent address or add a second Signed-off-by for the sending
   address.

4. The patch addresses two independent issues: fixing the packet_id in
   brcmf_cyw_mgmt_tx() (SAE auth frame TX) and fixing the zero-init and
   PMKID copy in brcmf_cyw_external_auth() (auth completion). Please
   split these into two separate patches.

Please send a v2 addressing these points.

[1] https://lore.kernel.org/linux-wireless/20260709122315.11400-1-bogdan.nicolae@gmail.com/

Regards,
Arend

Arend,

Sounds good. Do you prefer two patches in a single email or two separate emails?

Best,
Bogdan

On Mon, Jul 20, 2026 at 2:49 PM Arend van Spriel
<arend.vanspriel@broadcom.com> wrote:
>
> On Tue, 14 Jul 2026, bogdan.nicolae@gmail.com wrote:
>
> > [PATCH] wifi: brcmfmac: cyw: clean up PMKID and cookie code
>
> The code itself is correct, but there are process issues that need to be
> fixed before I can accept this:
>
> 1. This is a resubmission of the patch sent on 2026-07-09 [1]. A
>    resubmission must carry a version tag: the subject line should read
>    "[PATCH v2] wifi: brcmfmac: ..." not "[PATCH] wifi: brcmfmac: ...".
>
> 2. A v2 submission must include a "Changes in v2:" section below the ---
>    line documenting what changed from v1.
>
> 3. The From: address (bogdan.nicolae@gmail.com) does not match the
>    Signed-off-by address (bogdan.nicolae@acm.org). Please use a
>    consistent address or add a second Signed-off-by for the sending
>    address.
>
> 4. The patch addresses two independent issues: fixing the packet_id in
>    brcmf_cyw_mgmt_tx() (SAE auth frame TX) and fixing the zero-init and
>    PMKID copy in brcmf_cyw_external_auth() (auth completion). Please
>    split these into two separate patches.
>
> Please send a v2 addressing these points.
>
> [1] https://lore.kernel.org/linux-wireless/20260709122315.11400-1-bogdan.nicolae@gmail.com/
>
> Regards,
> Arend

On 20/07/2026 23:30, Bogdan Nicolae wrote:
> Arend,
> 
> Sounds good. Do you prefer two patches in a single email or two separate emails?

Way easier to deal with separate emails as we use patchwork to track them.

Regards,
Arend