hostapd: Update to version 2016-05-05

Fixes CVE-2016-4476 and few possible memory leaks.

Signed-off-by: Michal Hrusecky <Michal.Hrusecky@nic.cz>

8 files changed, 180 insertions, 103 deletions

diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile
index d843548580..3b8ceb40b9 100644
--- a/package/network/services/hostapd/Makefile
+++ b/package/network/services/hostapd/Makefile
@@ -7,9 +7,9 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_VERSION:=2016-01-15
-PKG_RELEASE:=2
-PKG_REV:=e15dcf6d1bc2725388555523effca75b1ffab735
+PKG_VERSION:=2016-05-05
+PKG_RELEASE:=1
+PKG_REV:=9524e7e5a4a18539f0fb532544d2de63621b5f8b
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=git://w1.fi/srv/git/hostap.git
diff --git a/package/network/services/hostapd/patches/200-multicall.patch b/package/network/services/hostapd/patches/200-multicall.patch
index 08f1e95a4f..49e7af74d8 100644
--- a/package/network/services/hostapd/patches/200-multicall.patch
+++ b/package/network/services/hostapd/patches/200-multicall.patch
@@ -1,15 +1,15 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -32,6 +32,7 @@ export BINDIR ?= /usr/local/bin/
- # CFLAGS += -DUSE_KERNEL_HEADERS -I/usr/src/linux/include
+@@ -28,6 +28,7 @@ CFLAGS += -I$(abspath ../src/utils)
+ export BINDIR ?= /usr/local/bin/
  
  -include .config
 +-include $(if $(MULTICALL), ../wpa_supplicant/.config)
  
  ifndef CONFIG_NO_GITVER
  # Add VERSION_STR postfix for builds from a git repository
-@@ -277,10 +278,14 @@ ifdef CONFIG_IEEE80211AC
- CFLAGS += -DCONFIG_IEEE80211AC
+@@ -315,10 +316,14 @@ CFLAGS += -DCONFIG_MBO
+ OBJS += ../src/ap/mbo_ap.o
  endif
  
 +ifndef MULTICALL
@@ -26,7 +26,7 @@
  LIBS += $(DRV_AP_LIBS)
  
  ifdef CONFIG_L2_PACKET
-@@ -1019,6 +1024,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
+@@ -1051,6 +1056,12 @@ install: $(addprefix $(DESTDIR)$(BINDIR)
  
  BCHECK=../src/drivers/build.hostapd
  
@@ -39,7 +39,7 @@
  hostapd: $(BCHECK) $(OBJS)
  	$(Q)$(CC) $(LDFLAGS) -o hostapd $(OBJS) $(LIBS)
  	@$(E) "  LD " $@
-@@ -1060,6 +1071,12 @@ HOBJS += ../src/crypto/aes-internal.o
+@@ -1092,6 +1103,12 @@ HOBJS += ../src/crypto/aes-internal.o
  HOBJS += ../src/crypto/aes-internal-enc.o
  endif
  
@@ -62,7 +62,7 @@
  
  ifndef CONFIG_NO_GITVER
  # Add VERSION_STR postfix for builds from a git repository
-@@ -794,6 +795,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
+@@ -803,6 +804,10 @@ ifdef CONFIG_DYNAMIC_EAP_METHODS
  CFLAGS += -DCONFIG_DYNAMIC_EAP_METHODS
  LIBS += -ldl -rdynamic
  endif
@@ -73,7 +73,7 @@
  endif
  
  ifdef CONFIG_MACSEC
-@@ -814,9 +819,11 @@ NEED_EAP_COMMON=y
+@@ -823,9 +828,11 @@ NEED_EAP_COMMON=y
  NEED_RSN_AUTHENTICATOR=y
  CFLAGS += -DCONFIG_AP
  OBJS += ap.o
@@ -85,7 +85,7 @@
  OBJS += ../src/ap/hostapd.o
  OBJS += ../src/ap/wpa_auth_glue.o
  OBJS += ../src/ap/utils.o
-@@ -879,10 +886,18 @@ endif
+@@ -898,10 +905,18 @@ endif
  ifdef CONFIG_HS20
  OBJS += ../src/ap/hs20.o
  endif
@@ -104,7 +104,7 @@
  NEED_AES_WRAP=y
  OBJS += ../src/ap/wpa_auth.o
  OBJS += ../src/ap/wpa_auth_ie.o
-@@ -1657,6 +1672,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
+@@ -1680,6 +1695,12 @@ wpa_priv: $(BCHECK) $(OBJS_priv)
  
  $(OBJS_c) $(OBJS_t) $(OBJS_t2) $(OBJS) $(BCHECK) $(EXTRA_progs): .config
  
@@ -117,8 +117,8 @@
  wpa_supplicant: $(BCHECK) $(OBJS) $(EXTRA_progs)
  	$(Q)$(LDO) $(LDFLAGS) -o wpa_supplicant $(OBJS) $(LIBS) $(EXTRALIBS)
  	@$(E) "  LD " $@
-@@ -1757,6 +1778,12 @@ endif
- 	$(Q)sed -e 's|\@BINDIR\@|$(BINDIR)|g' $< >$@
+@@ -1782,6 +1803,12 @@ endif
+ 		-e 's|\@DBUS_INTERFACE\@|$(DBUS_INTERFACE)|g' $< >$@
  	@$(E) "  sed" $<
  
 +dump_cflags:
@@ -132,7 +132,7 @@
  wpa_cli.exe: wpa_cli
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
-@@ -4707,8 +4707,8 @@ union wpa_event_data {
+@@ -4775,8 +4775,8 @@ union wpa_event_data {
   * Driver wrapper code should call this function whenever an event is received
   * from the driver.
   */
@@ -141,11 +141,20 @@
 +extern void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
 +				    union wpa_event_data *data);
  
+ /**
+  * wpa_supplicant_event_global - Report a driver event for wpa_supplicant
+@@ -4788,7 +4788,7 @@ void wpa_supplicant_event(void *ctx, enu
+  * Same as wpa_supplicant_event(), but we search for the interface in
+  * wpa_global.
+  */
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++extern void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
+ 				 union wpa_event_data *data);
  
  /*
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -1122,8 +1122,8 @@ static void hostapd_event_dfs_cac_starte
+@@ -1144,8 +1144,8 @@ static void hostapd_event_dfs_cac_starte
  #endif /* NEED_AP_MLME */
  
  
@@ -156,9 +165,18 @@
  {
  	struct hostapd_data *hapd = ctx;
  #ifndef CONFIG_NO_STDOUT_DEBUG
+@@ -1354,7 +1354,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+ 
+ 
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++void hostapd_wpa_event_global(void *ctx, enum wpa_event_type event,
+ 				 union wpa_event_data *data)
+ {
+ 	struct hapd_interfaces *interfaces = ctx;
 --- a/wpa_supplicant/wpa_priv.c
 +++ b/wpa_supplicant/wpa_priv.c
-@@ -932,8 +932,8 @@ static void wpa_priv_send_ft_response(st
+@@ -940,8 +940,8 @@ static void wpa_priv_send_ft_response(st
  }
  
  
@@ -169,17 +187,27 @@
  {
  	struct wpa_priv_interface *iface = ctx;
  
-@@ -1082,6 +1082,7 @@ int main(int argc, char *argv[])
+@@ -1010,7 +1010,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+ 
+ 
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++void supplicant_event_global(void *ctx, enum wpa_event_type event,
+ 				 union wpa_event_data *data)
+ {
+ 	struct wpa_priv_global *global = ctx;
+@@ -1122,6 +1122,8 @@ int main(int argc, char *argv[])
  	if (os_program_init())
  		return -1;
  
 +	wpa_supplicant_event = supplicant_event;
++	wpa_supplicant_event_global = supplicant_event_global;
  	wpa_priv_fd_workaround();
  
- 	for (;;) {
+ 	os_memset(&global, 0, sizeof(global));
 --- a/wpa_supplicant/events.c
 +++ b/wpa_supplicant/events.c
-@@ -3298,8 +3298,8 @@ static void wpa_supplicant_event_assoc_a
+@@ -3375,8 +3375,8 @@ static void wpa_supplicant_event_assoc_a
  }
  
  
@@ -190,7 +218,7 @@
  {
  	struct wpa_supplicant *wpa_s = ctx;
  	int resched;
-@@ -3947,7 +3947,7 @@ void wpa_supplicant_event(void *ctx, enu
+@@ -4037,7 +4037,7 @@ void wpa_supplicant_event(void *ctx, enu
  #endif /* CONFIG_AP */
  		break;
  	case EVENT_ACS_CHANNEL_SELECTED:
@@ -199,61 +227,86 @@
  		if (!wpa_s->ap_iface)
  			break;
  		hostapd_acs_channel_selected(wpa_s->ap_iface->bss[0],
+@@ -4051,7 +4051,7 @@ void wpa_supplicant_event(void *ctx, enu
+ }
+ 
+ 
+-void wpa_supplicant_event_global(void *ctx, enum wpa_event_type event,
++void supplicant_event_global(void *ctx, enum wpa_event_type event,
+ 				 union wpa_event_data *data)
+ {
+ 	struct wpa_supplicant *wpa_s;
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -4845,6 +4845,9 @@ static void wpa_supplicant_deinit_iface(
- 	os_free(wpa_s);
+@@ -4967,7 +4967,6 @@ struct wpa_interface * wpa_supplicant_ma
+ 	return NULL;
  }
  
+-
+ /**
+  * wpa_supplicant_match_existing - Match existing interfaces
+  * @global: Pointer to global data from wpa_supplicant_init()
+@@ -5004,6 +5003,11 @@ static int wpa_supplicant_match_existing
+ 
+ #endif /* CONFIG_MATCH_IFACE */
+ 
 +extern void supplicant_event(void *ctx, enum wpa_event_type event,
 +			     union wpa_event_data *data);
 +
++extern void supplicant_event_global(void *ctx, enum wpa_event_type event,
++ 				 union wpa_event_data *data);
  
  /**
   * wpa_supplicant_add_iface - Add a new network interface
-@@ -5100,6 +5103,7 @@ struct wpa_global * wpa_supplicant_init(
+@@ -5259,6 +5263,8 @@ struct wpa_global * wpa_supplicant_init(
  #ifndef CONFIG_NO_WPA_MSG
  	wpa_msg_register_ifname_cb(wpa_supplicant_msg_ifname_cb);
  #endif /* CONFIG_NO_WPA_MSG */
 +	wpa_supplicant_event = supplicant_event;
++	wpa_supplicant_event_global = supplicant_event_global;
  
  	if (params->wpa_debug_file_path)
  		wpa_debug_open_file(params->wpa_debug_file_path);
 --- a/hostapd/main.c
 +++ b/hostapd/main.c
-@@ -513,6 +513,9 @@ static int hostapd_get_ctrl_iface_group(
+@@ -526,6 +526,11 @@ static int hostapd_get_ctrl_iface_group(
  	return 0;
  }
  
 +void hostapd_wpa_event(void *ctx, enum wpa_event_type event,
 +                       union wpa_event_data *data);
 +
++void hostapd_wpa_event_global(void *ctx, enum wpa_event_type event,
++ 				 union wpa_event_data *data);
  
  #ifdef CONFIG_WPS
  static int gen_uuid(const char *txt_addr)
-@@ -588,6 +591,7 @@ int main(int argc, char *argv[])
+@@ -601,6 +606,8 @@ int main(int argc, char *argv[])
  	interfaces.global_ctrl_sock = -1;
- 	interfaces.global_ctrl_dst = NULL;
+ 	dl_list_init(&interfaces.global_ctrl_dst);
  
 +	wpa_supplicant_event = hostapd_wpa_event;
++	wpa_supplicant_event_global = hostapd_wpa_event_global;
  	for (;;) {
  		c = getopt(argc, argv, "b:Bde:f:hKP:STtu:vg:G:");
  		if (c < 0)
 --- a/src/drivers/drivers.c
 +++ b/src/drivers/drivers.c
-@@ -10,6 +10,9 @@
+@@ -10,6 +10,11 @@
  #include "utils/common.h"
  #include "driver.h"
  
 +void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
 +			     union wpa_event_data *data);
++void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
++			     union wpa_event_data *data);
 +
  #ifdef CONFIG_DRIVER_WEXT
  extern struct wpa_driver_ops wpa_driver_wext_ops; /* driver_wext.c */
  #endif /* CONFIG_DRIVER_WEXT */
 --- a/wpa_supplicant/eapol_test.c
 +++ b/wpa_supplicant/eapol_test.c
-@@ -29,7 +29,10 @@
+@@ -29,7 +29,12 @@
  #include "ctrl_iface.h"
  #include "pcsc_funcs.h"
  #include "wpas_glue.h"
@@ -261,23 +314,28 @@
  
 +void (*wpa_supplicant_event)(void *ctx, enum wpa_event_type event,
 +			     union wpa_event_data *data);
++void (*wpa_supplicant_event_global)(void *ctx, enum wpa_event_type event,
++			     union wpa_event_data *data);
  
  const struct wpa_driver_ops *const wpa_drivers[] = { NULL };
  
-@@ -1288,6 +1291,8 @@ static void usage(void)
+@@ -1295,6 +1300,10 @@ static void usage(void)
  	       "option several times.\n");
  }
  
 +extern void supplicant_event(void *ctx, enum wpa_event_type event,
 +			     union wpa_event_data *data);
++extern void supplicant_event_global(void *ctx, enum wpa_event_type event,
++			     union wpa_event_data *data);
  
  int main(int argc, char *argv[])
  {
-@@ -1308,6 +1313,7 @@ int main(int argc, char *argv[])
+@@ -1315,6 +1324,8 @@ int main(int argc, char *argv[])
  	if (os_program_init())
  		return -1;
  
 +	wpa_supplicant_event = supplicant_event;
++	wpa_supplicant_event_global = supplicant_event_global;
  	hostapd_logger_register_cb(hostapd_logger_cb);
  
  	os_memset(&eapol_test, 0, sizeof(eapol_test));
diff --git a/package/network/services/hostapd/patches/370-ap_sta_support.patch b/package/network/services/hostapd/patches/370-ap_sta_support.patch
index 716916a0f0..04c52a2b5c 100644
--- a/package/network/services/hostapd/patches/370-ap_sta_support.patch
+++ b/package/network/services/hostapd/patches/370-ap_sta_support.patch
@@ -1,6 +1,6 @@
 --- a/wpa_supplicant/wpa_supplicant_i.h
 +++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -99,6 +99,11 @@ struct wpa_interface {
+@@ -100,6 +100,11 @@ struct wpa_interface {
  	const char *ifname;
  
  	/**
@@ -12,8 +12,8 @@
  	 * bridge_ifname - Optional bridge interface name
  	 *
  	 * If the driver interface (ifname) is included in a Linux bridge
-@@ -465,6 +470,8 @@ struct wpa_supplicant {
- #endif /* CONFIG_CTRL_IFACE_DBUS_NEW */
+@@ -484,6 +489,8 @@ struct wpa_supplicant {
+ #endif /* CONFIG_CTRL_IFACE_BINDER */
  	char bridge_ifname[16];
  
 +	struct wpa_ctrl *hostapd;
@@ -45,7 +45,7 @@
  CONFIG_OS=win32
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -108,6 +108,55 @@ const char *const wpa_supplicant_full_li
+@@ -112,6 +112,55 @@ const char *const wpa_supplicant_full_li
  "\n";
  #endif /* CONFIG_NO_STDOUT_DEBUG */
  
@@ -101,7 +101,7 @@
  /* Configure default/group WEP keys for static WEP */
  int wpa_set_wep_keys(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
  {
-@@ -783,8 +832,12 @@ void wpa_supplicant_set_state(struct wpa
+@@ -812,8 +861,12 @@ void wpa_supplicant_set_state(struct wpa
  		wpas_p2p_completed(wpa_s);
  
  		sme_sched_obss_scan(wpa_s, 1);
@@ -114,7 +114,7 @@
  		wpa_s->new_connection = 1;
  		wpa_drv_set_operstate(wpa_s, 0);
  #ifndef IEEE8021X_EAPOL
-@@ -4537,6 +4590,20 @@ static int wpa_supplicant_init_iface(str
+@@ -4623,6 +4676,20 @@ static int wpa_supplicant_init_iface(str
  			   sizeof(wpa_s->bridge_ifname));
  	}
  
@@ -135,7 +135,7 @@
  	/* RSNA Supplicant Key Management - INITIALIZE */
  	eapol_sm_notify_portEnabled(wpa_s->eapol, FALSE);
  	eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
-@@ -4823,6 +4890,11 @@ static void wpa_supplicant_deinit_iface(
+@@ -4914,6 +4981,11 @@ static void wpa_supplicant_deinit_iface(
  	if (terminate)
  		wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_TERMINATING);
  
@@ -203,16 +203,16 @@
  	       "  -i = interface name\n"
  	       "  -I = additional configuration file\n"
  	       "  -K = include keys (passwords, etc.) in debug output\n"
-@@ -176,7 +177,7 @@ int main(int argc, char *argv[])
+@@ -201,7 +202,7 @@ int main(int argc, char *argv[])
  
  	for (;;) {
  		c = getopt(argc, argv,
--			   "b:Bc:C:D:de:f:g:G:hi:I:KLm:No:O:p:P:qsTtuvW");
-+			   "b:Bc:C:D:de:f:g:G:hH:i:I:KLm:No:O:p:P:qsTtuvW");
+-			   "b:Bc:C:D:de:f:g:G:hi:I:KLMm:No:O:p:P:qsTtuvW");
++			   "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuvW");
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -223,6 +224,9 @@ int main(int argc, char *argv[])
+@@ -248,6 +249,9 @@ int main(int argc, char *argv[])
  			usage();
  			exitcode = 0;
  			goto out;
diff --git a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
index 1e1aa20730..282577e639 100644
--- a/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
+++ b/package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch
@@ -1,18 +1,18 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -202,6 +202,9 @@ endif
+@@ -211,6 +211,9 @@ endif
  ifdef CONFIG_NO_CTRL_IFACE
  CFLAGS += -DCONFIG_NO_CTRL_IFACE
  else
 +ifdef CONFIG_CTRL_IFACE_MIB
 +CFLAGS += -DCONFIG_CTRL_IFACE_MIB
 +endif
- OBJS += ctrl_iface.o
- OBJS += ../src/ap/ctrl_iface_ap.o
- endif
+ ifeq ($(CONFIG_CTRL_IFACE), udp)
+ CFLAGS += -DCONFIG_CTRL_IFACE_UDP
+ else
 --- a/hostapd/ctrl_iface.c
 +++ b/hostapd/ctrl_iface.c
-@@ -2119,6 +2119,7 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -2342,6 +2342,7 @@ static int hostapd_ctrl_iface_receive_pr
  						      reply_size);
  	} else if (os_strcmp(buf, "STATUS-DRIVER") == 0) {
  		reply_len = hostapd_drv_status(hapd, reply, reply_size);
@@ -20,7 +20,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = ieee802_11_get_mib(hapd, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -2160,6 +2161,7 @@ static int hostapd_ctrl_iface_receive_pr
+@@ -2383,6 +2384,7 @@ static int hostapd_ctrl_iface_receive_pr
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = hostapd_ctrl_iface_sta_next(hapd, buf + 9, reply,
  							reply_size);
@@ -30,8 +30,8 @@
  			reply_len = -1;
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -858,6 +858,9 @@ ifdef CONFIG_WNM
- OBJS += ../src/ap/wnm_ap.o
+@@ -872,6 +872,9 @@ ifdef CONFIG_MBO
+ OBJS += ../src/ap/mbo_ap.o
  endif
  ifdef CONFIG_CTRL_IFACE
 +ifdef CONFIG_CTRL_IFACE_MIB
@@ -42,7 +42,7 @@
  
 --- a/wpa_supplicant/ctrl_iface.c
 +++ b/wpa_supplicant/ctrl_iface.c
-@@ -1858,7 +1858,7 @@ static int wpa_supplicant_ctrl_iface_sta
+@@ -1895,7 +1895,7 @@ static int wpa_supplicant_ctrl_iface_sta
  			pos += ret;
  		}
  
@@ -51,7 +51,7 @@
  		if (wpa_s->ap_iface) {
  			pos += ap_ctrl_iface_wpa_get_status(wpa_s, pos,
  							    end - pos,
-@@ -8352,6 +8352,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -8610,6 +8610,7 @@ char * wpa_supplicant_ctrl_iface_process
  			reply_len = -1;
  	} else if (os_strncmp(buf, "NOTE ", 5) == 0) {
  		wpa_printf(MSG_INFO, "NOTE: %s", buf + 5);
@@ -59,7 +59,7 @@
  	} else if (os_strcmp(buf, "MIB") == 0) {
  		reply_len = wpa_sm_get_mib(wpa_s->wpa, reply, reply_size);
  		if (reply_len >= 0) {
-@@ -8359,6 +8360,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -8617,6 +8618,7 @@ char * wpa_supplicant_ctrl_iface_process
  						      reply + reply_len,
  						      reply_size - reply_len);
  		}
@@ -67,7 +67,7 @@
  	} else if (os_strncmp(buf, "STATUS", 6) == 0) {
  		reply_len = wpa_supplicant_ctrl_iface_status(
  			wpa_s, buf + 6, reply, reply_size);
-@@ -8821,6 +8823,7 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -9087,6 +9089,7 @@ char * wpa_supplicant_ctrl_iface_process
  		reply_len = wpa_supplicant_ctrl_iface_bss(
  			wpa_s, buf + 4, reply, reply_size);
  #ifdef CONFIG_AP
@@ -75,7 +75,7 @@
  	} else if (os_strcmp(buf, "STA-FIRST") == 0) {
  		reply_len = ap_ctrl_iface_sta_first(wpa_s, reply, reply_size);
  	} else if (os_strncmp(buf, "STA ", 4) == 0) {
-@@ -8829,12 +8832,15 @@ char * wpa_supplicant_ctrl_iface_process
+@@ -9095,12 +9098,15 @@ char * wpa_supplicant_ctrl_iface_process
  	} else if (os_strncmp(buf, "STA-NEXT ", 9) == 0) {
  		reply_len = ap_ctrl_iface_sta_next(wpa_s, buf + 9, reply,
  						   reply_size);
@@ -93,15 +93,15 @@
  			reply_len = -1;
 --- a/src/ap/ctrl_iface_ap.c
 +++ b/src/ap/ctrl_iface_ap.c
-@@ -23,6 +23,7 @@
- #include "ctrl_iface_ap.h"
+@@ -24,6 +24,7 @@
  #include "ap_drv_ops.h"
+ #include "mbo_ap.h"
  
 +#ifdef CONFIG_CTRL_IFACE_MIB
  
  static int hostapd_get_sta_tx_rx(struct hostapd_data *hapd,
  				 struct sta_info *sta,
-@@ -235,6 +236,7 @@ int hostapd_ctrl_iface_sta_next(struct h
+@@ -249,6 +250,7 @@ int hostapd_ctrl_iface_sta_next(struct h
  	return hostapd_ctrl_iface_sta_mib(hapd, sta->next, buf, buflen);
  }
  
@@ -111,7 +111,7 @@
  static int p2p_manager_disconnect(struct hostapd_data *hapd, u16 stype,
 --- a/src/ap/ieee802_1x.c
 +++ b/src/ap/ieee802_1x.c
-@@ -2359,6 +2359,7 @@ static const char * bool_txt(Boolean val
+@@ -2441,6 +2441,7 @@ static const char * bool_txt(Boolean val
  	return val ? "TRUE" : "FALSE";
  }
  
@@ -119,7 +119,7 @@
  
  int ieee802_1x_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
  {
-@@ -2534,6 +2535,7 @@ int ieee802_1x_get_mib_sta(struct hostap
+@@ -2616,6 +2617,7 @@ int ieee802_1x_get_mib_sta(struct hostap
  	return len;
  }
  
@@ -167,7 +167,7 @@
  
 --- a/wpa_supplicant/ap.c
 +++ b/wpa_supplicant/ap.c
-@@ -1091,7 +1091,7 @@ int wpas_ap_wps_nfc_report_handover(stru
+@@ -1103,7 +1103,7 @@ int wpas_ap_wps_nfc_report_handover(stru
  #endif /* CONFIG_WPS */
  
  
diff --git a/package/network/services/hostapd/patches/420-indicate-features.patch b/package/network/services/hostapd/patches/420-indicate-features.patch
index 234537a7bc..f2dff789ed 100644
--- a/package/network/services/hostapd/patches/420-indicate-features.patch
+++ b/package/network/services/hostapd/patches/420-indicate-features.patch
@@ -8,7 +8,7 @@
  #include "crypto/random.h"
  #include "crypto/tls.h"
  #include "common/version.h"
-@@ -593,7 +594,7 @@ int main(int argc, char *argv[])
+@@ -606,7 +607,7 @@ int main(int argc, char *argv[])
  
  	wpa_supplicant_event = hostapd_wpa_event;
  	for (;;) {
@@ -17,7 +17,7 @@
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -630,6 +631,8 @@ int main(int argc, char *argv[])
+@@ -643,6 +644,8 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_DEBUG_LINUX_TRACING */
  		case 'v':
@@ -36,16 +36,16 @@
  #include "fst/fst.h"
  #include "wpa_supplicant_i.h"
  #include "driver_i.h"
-@@ -177,7 +178,7 @@ int main(int argc, char *argv[])
+@@ -202,7 +203,7 @@ int main(int argc, char *argv[])
  
  	for (;;) {
  		c = getopt(argc, argv,
--			   "b:Bc:C:D:de:f:g:G:hH:i:I:KLm:No:O:p:P:qsTtuvW");
-+			   "b:Bc:C:D:de:f:g:G:hH:i:I:KLm:No:O:p:P:qsTtuv::W");
+-			   "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuvW");
++			   "b:Bc:C:D:de:f:g:G:hH:i:I:KLMm:No:O:p:P:qsTtuv::W");
  		if (c < 0)
  			break;
  		switch (c) {
-@@ -280,8 +281,12 @@ int main(int argc, char *argv[])
+@@ -305,8 +306,12 @@ int main(int argc, char *argv[])
  			break;
  #endif /* CONFIG_DBUS */
  		case 'v':
diff --git a/package/network/services/hostapd/patches/450-scan_wait.patch b/package/network/services/hostapd/patches/450-scan_wait.patch
index 192006a872..3a787e324e 100644
--- a/package/network/services/hostapd/patches/450-scan_wait.patch
+++ b/package/network/services/hostapd/patches/450-scan_wait.patch
@@ -33,7 +33,7 @@
  	/* Initialize the driver interface */
  	if (!(b[0] | b[1] | b[2] | b[3] | b[4] | b[5]))
  		b = NULL;
-@@ -382,8 +394,6 @@ static void hostapd_global_deinit(const
+@@ -383,8 +395,6 @@ static void hostapd_global_deinit(const
  #endif /* CONFIG_NATIVE_WINDOWS */
  
  	eap_server_unregister_methods();
@@ -42,19 +42,26 @@
  }
  
  
-@@ -409,11 +419,6 @@ static int hostapd_global_run(struct hap
+@@ -410,18 +420,6 @@ static int hostapd_global_run(struct hap
  	}
  #endif /* EAP_SERVER_TNC */
  
--	if (daemonize && os_daemonize(pid_file)) {
--		wpa_printf(MSG_ERROR, "daemon: %s", strerror(errno));
--		return -1;
+-	if (daemonize) {
+-		if (os_daemonize(pid_file)) {
+-			wpa_printf(MSG_ERROR, "daemon: %s", strerror(errno));
+-			return -1;
+-		}
+-		if (eloop_sock_requeue()) {
+-			wpa_printf(MSG_ERROR, "eloop_sock_requeue: %s",
+-				   strerror(errno));
+-			return -1;
+-		}
 -	}
 -
  	eloop_run();
  
  	return 0;
-@@ -566,8 +571,7 @@ int main(int argc, char *argv[])
+@@ -579,8 +577,7 @@ int main(int argc, char *argv[])
  	struct hapd_interfaces interfaces;
  	int ret = 1;
  	size_t i, j;
diff --git a/package/network/services/hostapd/patches/600-ubus_support.patch b/package/network/services/hostapd/patches/600-ubus_support.patch
index d5767259b6..5936ef47fd 100644
--- a/package/network/services/hostapd/patches/600-ubus_support.patch
+++ b/package/network/services/hostapd/patches/600-ubus_support.patch
@@ -1,6 +1,6 @@
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
-@@ -155,6 +155,11 @@ OBJS += ../src/common/hw_features_common
+@@ -157,6 +157,11 @@ OBJS += ../src/common/hw_features_common
  
  OBJS += ../src/eapol_auth/eapol_auth_sm.o
  
@@ -22,7 +22,7 @@
  
  struct wpa_ctrl_dst;
  struct radius_server_data;
-@@ -107,6 +108,7 @@ struct hostapd_data {
+@@ -117,6 +118,7 @@ struct hostapd_data {
  	struct hostapd_iface *iface;
  	struct hostapd_config *iconf;
  	struct hostapd_bss_config *conf;
@@ -30,7 +30,7 @@
  	int interface_added; /* virtual interface added for this BSS */
  	unsigned int started:1;
  	unsigned int disabled:1;
-@@ -299,6 +301,8 @@ struct hostapd_iface {
+@@ -322,6 +324,8 @@ struct hostapd_iface {
  	struct hostapd_config *conf;
  	char phy[16]; /* Name of the PHY (radio) */
  
@@ -661,7 +661,7 @@
 +#endif
 --- a/src/ap/hostapd.c
 +++ b/src/ap/hostapd.c
-@@ -280,6 +280,7 @@ static void hostapd_free_hapd_data(struc
+@@ -282,6 +282,7 @@ static void hostapd_free_hapd_data(struc
  	hapd->started = 0;
  
  	wpa_printf(MSG_DEBUG, "%s(%s)", __func__, hapd->conf->iface);
@@ -669,7 +669,7 @@
  	iapp_deinit(hapd->iapp);
  	hapd->iapp = NULL;
  	accounting_deinit(hapd);
-@@ -1118,6 +1119,8 @@ static int hostapd_setup_bss(struct host
+@@ -1137,6 +1138,8 @@ static int hostapd_setup_bss(struct host
  	if (hapd->driver && hapd->driver->set_operstate)
  		hapd->driver->set_operstate(hapd->drv_priv, 1);
  
@@ -678,7 +678,7 @@
  	return 0;
  }
  
-@@ -1523,6 +1526,7 @@ static int hostapd_setup_interface_compl
+@@ -1662,6 +1665,7 @@ static int hostapd_setup_interface_compl
  	if (err)
  		goto fail;
  
@@ -686,7 +686,7 @@
  	wpa_printf(MSG_DEBUG, "Completing interface initialization");
  	if (iface->conf->channel) {
  #ifdef NEED_AP_MLME
-@@ -1700,6 +1704,7 @@ dfs_offload:
+@@ -1842,6 +1846,7 @@ dfs_offload:
  
  fail:
  	wpa_printf(MSG_ERROR, "Interface initialization failed");
@@ -694,7 +694,7 @@
  	hostapd_set_state(iface, HAPD_IFACE_DISABLED);
  	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_EVENT_DISABLED);
  #ifdef CONFIG_FST
-@@ -2125,6 +2130,7 @@ void hostapd_interface_deinit_free(struc
+@@ -2268,6 +2273,7 @@ void hostapd_interface_deinit_free(struc
  		   (unsigned int) iface->conf->num_bss);
  	driver = iface->bss[0]->driver;
  	drv_priv = iface->bss[0]->drv_priv;
@@ -704,7 +704,7 @@
  		   __func__, driver, drv_priv);
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -877,7 +877,8 @@ int auth_sae_init_committed(struct hosta
+@@ -929,7 +929,8 @@ int auth_sae_init_committed(struct hosta
  
  
  static void handle_auth(struct hostapd_data *hapd,
@@ -714,7 +714,7 @@
  {
  	u16 auth_alg, auth_transaction, status_code;
  	u16 resp = WLAN_STATUS_SUCCESS;
-@@ -893,6 +894,11 @@ static void handle_auth(struct hostapd_d
+@@ -945,6 +946,11 @@ static void handle_auth(struct hostapd_d
  	char *identity = NULL;
  	char *radius_cui = NULL;
  	u16 seq_ctrl;
@@ -724,9 +724,9 @@
 +		.frame_info = fi,
 +	};
  
- 	if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
- 		wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
-@@ -1044,6 +1050,14 @@ static void handle_auth(struct hostapd_d
+ 	os_memset(&vlan_id, 0, sizeof(vlan_id));
+ 
+@@ -1098,6 +1104,14 @@ static void handle_auth(struct hostapd_d
  		resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
  		goto fail;
  	}
@@ -741,7 +741,7 @@
  	if (res == HOSTAPD_ACL_PENDING) {
  		wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
  			   " waiting for an external authentication",
-@@ -1776,13 +1790,18 @@ static void send_assoc_resp(struct hosta
+@@ -1982,13 +1996,18 @@ static u16 send_assoc_resp(struct hostap
  
  static void handle_assoc(struct hostapd_data *hapd,
  			 const struct ieee80211_mgmt *mgmt, size_t len,
@@ -749,7 +749,7 @@
 +			 int reassoc, struct hostapd_frame_info *fi)
  {
  	u16 capab_info, listen_interval, seq_ctrl, fc;
- 	u16 resp = WLAN_STATUS_SUCCESS;
+ 	u16 resp = WLAN_STATUS_SUCCESS, reply_res;
  	const u8 *pos;
  	int left, i;
  	struct sta_info *sta;
@@ -761,9 +761,9 @@
  
  	if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
  				      sizeof(mgmt->u.assoc_req))) {
-@@ -1902,6 +1921,13 @@ static void handle_assoc(struct hostapd_
- 		goto fail;
+@@ -2108,6 +2127,13 @@ static void handle_assoc(struct hostapd_
  	}
+ #endif /* CONFIG_MBO */
  
 +	if (hostapd_ubus_handle_event(hapd, &req)) {
 +		wpa_printf(MSG_DEBUG, "Station " MACSTR " assoc rejected by ubus handler.\n",
@@ -772,10 +772,10 @@
 +		goto fail;
 +	}
 +
- 	sta->capability = capab_info;
- 	sta->listen_interval = listen_interval;
- 
-@@ -2328,7 +2354,7 @@ int ieee802_11_mgmt(struct hostapd_data
+ 	/*
+ 	 * sta->capability is used in check_assoc_ies() for RRM enabled
+ 	 * capability element.
+@@ -2588,7 +2614,7 @@ int ieee802_11_mgmt(struct hostapd_data
  
  
  	if (stype == WLAN_FC_STYPE_PROBE_REQ) {
@@ -784,7 +784,7 @@
  		return 1;
  	}
  
-@@ -2346,17 +2372,17 @@ int ieee802_11_mgmt(struct hostapd_data
+@@ -2606,17 +2632,17 @@ int ieee802_11_mgmt(struct hostapd_data
  	switch (stype) {
  	case WLAN_FC_STYPE_AUTH:
  		wpa_printf(MSG_DEBUG, "mgmt::auth");
@@ -807,7 +807,7 @@
  	case WLAN_FC_STYPE_DISASSOC:
 --- a/src/ap/beacon.c
 +++ b/src/ap/beacon.c
-@@ -667,7 +667,7 @@ sta_track_seen_on(struct hostapd_iface *
+@@ -675,7 +675,7 @@ sta_track_seen_on(struct hostapd_iface *
  
  void handle_probe_req(struct hostapd_data *hapd,
  		      const struct ieee80211_mgmt *mgmt, size_t len,
@@ -816,7 +816,7 @@
  {
  	u8 *resp;
  	struct ieee802_11_elems elems;
-@@ -676,9 +676,15 @@ void handle_probe_req(struct hostapd_dat
+@@ -684,9 +684,15 @@ void handle_probe_req(struct hostapd_dat
  	size_t i, resp_len;
  	int noack;
  	enum ssid_match_result res;
@@ -830,9 +830,9 @@
 +		.frame_info = fi,
 +	};
  
- 	ie = mgmt->u.probe_req.variable;
- 	if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.probe_req))
-@@ -830,6 +836,12 @@ void handle_probe_req(struct hostapd_dat
+ 	if (len < IEEE80211_HDRLEN)
+ 		return;
+@@ -838,6 +844,12 @@ void handle_probe_req(struct hostapd_dat
  	}
  #endif /* CONFIG_P2P */
  
@@ -858,7 +858,7 @@
  int ieee802_11_update_beacons(struct hostapd_iface *iface);
 --- a/src/ap/drv_callbacks.c
 +++ b/src/ap/drv_callbacks.c
-@@ -51,6 +51,10 @@ int hostapd_notif_assoc(struct hostapd_d
+@@ -52,6 +52,10 @@ int hostapd_notif_assoc(struct hostapd_d
  	u16 reason = WLAN_REASON_UNSPECIFIED;
  	u16 status = WLAN_STATUS_SUCCESS;
  	const u8 *p2p_dev_addr = NULL;
@@ -869,7 +869,7 @@
  
  	if (addr == NULL) {
  		/*
-@@ -123,6 +127,12 @@ int hostapd_notif_assoc(struct hostapd_d
+@@ -124,6 +128,12 @@ int hostapd_notif_assoc(struct hostapd_d
  		goto fail;
  	}
  
diff --git a/package/network/services/hostapd/patches/700-make-make-work.patch b/package/network/services/hostapd/patches/700-make-make-work.patch
new file mode 100644
index 0000000000..643061ab5b
--- /dev/null
+++ b/package/network/services/hostapd/patches/700-make-make-work.patch
@@ -0,0 +1,12 @@
+--- a/hostapd/Makefile
++++ b/hostapd/Makefile
+@@ -196,7 +196,8 @@ endif
+ 
+ ifdef CONFIG_NO_VLAN
+ CFLAGS += -DCONFIG_NO_VLAN
+-else
++endif
++ifneq ($(findstring CONFIG_NO_VLAN,$(CFLAGS)), CONFIG_NO_VLAN)
+ OBJS += ../src/ap/vlan_init.o
+ OBJS += ../src/ap/vlan_ifconfig.o
+ OBJS += ../src/ap/vlan.o