Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'wireless-2025-10-23' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
First set of fixes:
- brcmfmac: long-standing crash when used w/o P2P
- iwlwifi: fix for a use-after-free bug
- mac80211: key tailroom accounting bug could leave
allocation overhead and cause a warning
- ath11k: add a missing platform,
fix key flag operations
- bcma: skip devices disabled in OF/DT
- various (potential) memory leaks

* tag 'wireless-2025-10-23' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
wifi: nl80211: call kfree without a NULL check
wifi: mac80211: fix key tailroom accounting leak
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
MAINTAINERS: wcn36xx: Add linux-wireless list
bcma: don't register devices disabled in OF
wifi: mac80211: reset FILS discovery and unsol probe resp intervals
wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()
wifi: ath11k: avoid bit operation on key flags
wifi: ath12k: free skb during idr cleanup callback
wifi: ath11k: Add missing platform IDs for quirk table
wifi: ath10k: Fix memory leak on unsupported WMI command
====================

Link: https://patch.msgid.link/20251023180604.626946-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

+106 -56
+1
MAINTAINERS
··· 21318 21318 QUALCOMM WCN36XX WIRELESS DRIVER 21319 21319 M: Loic Poulain <loic.poulain@oss.qualcomm.com> 21320 21320 L: wcn36xx@lists.infradead.org 21321 + L: linux-wireless@vger.kernel.org 21321 21322 S: Supported 21322 21323 W: https://wireless.wiki.kernel.org/en/users/Drivers/wcn36xx 21323 21324 F: drivers/net/wireless/ath/wcn36xx/
+6
drivers/bcma/main.c
··· 294 294 int err; 295 295 296 296 list_for_each_entry(core, &bus->cores, list) { 297 + struct device_node *np; 298 + 297 299 /* We support that core ourselves */ 298 300 switch (core->id.id) { 299 301 case BCMA_CORE_4706_CHIPCOMMON: ··· 311 309 312 310 /* Early cores were already registered */ 313 311 if (bcma_is_core_needed_early(core->id.id)) 312 + continue; 313 + 314 + np = core->dev.of_node; 315 + if (np && !of_device_is_available(np)) 314 316 continue; 315 317 316 318 /* Only first GMAC core on BCM4706 is connected and working */
+1
drivers/net/wireless/ath/ath10k/wmi.c
··· 1937 1937 if (cmd_id == WMI_CMD_UNSUPPORTED) { 1938 1938 ath10k_warn(ar, "wmi command %d is not supported by firmware\n", 1939 1939 cmd_id); 1940 + dev_kfree_skb_any(skb); 1940 1941 return ret; 1941 1942 } 1942 1943
+48 -6
drivers/net/wireless/ath/ath11k/core.c
··· 912 912 static const struct dmi_system_id ath11k_pm_quirk_table[] = { 913 913 { 914 914 .driver_data = (void *)ATH11K_PM_WOW, 915 - .matches = { 915 + .matches = { /* X13 G4 AMD #1 */ 916 + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), 917 + DMI_MATCH(DMI_PRODUCT_NAME, "21J3"), 918 + }, 919 + }, 920 + { 921 + .driver_data = (void *)ATH11K_PM_WOW, 922 + .matches = { /* X13 G4 AMD #2 */ 916 923 DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), 917 924 DMI_MATCH(DMI_PRODUCT_NAME, "21J4"), 918 925 }, 919 926 }, 920 927 { 921 928 .driver_data = (void *)ATH11K_PM_WOW, 922 - .matches = { 929 + .matches = { /* T14 G4 AMD #1 */ 930 + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), 931 + DMI_MATCH(DMI_PRODUCT_NAME, "21K3"), 932 + }, 933 + }, 934 + { 935 + .driver_data = (void *)ATH11K_PM_WOW, 936 + .matches = { /* T14 G4 AMD #2 */ 923 937 DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), 924 938 DMI_MATCH(DMI_PRODUCT_NAME, "21K4"), 925 939 }, 926 940 }, 927 941 { 928 942 .driver_data = (void *)ATH11K_PM_WOW, 929 - .matches = { 943 + .matches = { /* P14s G4 AMD #1 */ 944 + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), 945 + DMI_MATCH(DMI_PRODUCT_NAME, "21K5"), 946 + }, 947 + }, 948 + { 949 + .driver_data = (void *)ATH11K_PM_WOW, 950 + .matches = { /* P14s G4 AMD #2 */ 930 951 DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), 931 952 DMI_MATCH(DMI_PRODUCT_NAME, "21K6"), 932 953 }, 933 954 }, 934 955 { 935 956 .driver_data = (void *)ATH11K_PM_WOW, 936 - .matches = { 957 + .matches = { /* T16 G2 AMD #1 */ 958 + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), 959 + DMI_MATCH(DMI_PRODUCT_NAME, "21K7"), 960 + }, 961 + }, 962 + { 963 + .driver_data = (void *)ATH11K_PM_WOW, 964 + .matches = { /* T16 G2 AMD #2 */ 937 965 DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), 938 966 DMI_MATCH(DMI_PRODUCT_NAME, "21K8"), 939 967 }, 940 968 }, 941 969 { 942 970 .driver_data = (void *)ATH11K_PM_WOW, 943 - .matches = { 971 + .matches = { /* P16s G2 AMD #1 */ 972 + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), 973 + DMI_MATCH(DMI_PRODUCT_NAME, "21K9"), 974 + }, 975 + }, 976 + { 977 + .driver_data = (void *)ATH11K_PM_WOW, 978 + .matches = { /* P16s G2 AMD #2 */ 944 979 DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), 945 980 DMI_MATCH(DMI_PRODUCT_NAME, "21KA"), 946 981 }, 947 982 }, 948 983 { 949 984 .driver_data = (void *)ATH11K_PM_WOW, 950 - .matches = { 985 + .matches = { /* T14s G4 AMD #1 */ 986 + DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), 987 + DMI_MATCH(DMI_PRODUCT_NAME, "21F8"), 988 + }, 989 + }, 990 + { 991 + .driver_data = (void *)ATH11K_PM_WOW, 992 + .matches = { /* T14s G4 AMD #2 */ 951 993 DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"), 952 994 DMI_MATCH(DMI_PRODUCT_NAME, "21F9"), 953 995 },
+5 -5
drivers/net/wireless/ath/ath11k/mac.c
··· 1 1 // SPDX-License-Identifier: BSD-3-Clause-Clear 2 2 /* 3 3 * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. 4 - * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. 4 + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. 5 5 */ 6 6 7 7 #include <net/mac80211.h> ··· 4417 4417 } 4418 4418 4419 4419 if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) 4420 - flags |= WMI_KEY_PAIRWISE; 4420 + flags = WMI_KEY_PAIRWISE; 4421 4421 else 4422 - flags |= WMI_KEY_GROUP; 4422 + flags = WMI_KEY_GROUP; 4423 4423 4424 4424 ath11k_dbg(ar->ab, ATH11K_DBG_MAC, 4425 4425 "%s for peer %pM on vdev %d flags 0x%X, type = %d, num_sta %d\n", ··· 4456 4456 4457 4457 is_ap_with_no_sta = (vif->type == NL80211_IFTYPE_AP && 4458 4458 !arvif->num_stations); 4459 - if ((flags & WMI_KEY_PAIRWISE) || cmd == SET_KEY || is_ap_with_no_sta) { 4459 + if (flags == WMI_KEY_PAIRWISE || cmd == SET_KEY || is_ap_with_no_sta) { 4460 4460 ret = ath11k_install_key(arvif, key, cmd, peer_addr, flags); 4461 4461 if (ret) { 4462 4462 ath11k_warn(ab, "ath11k_install_key failed (%d)\n", ret); ··· 4470 4470 goto exit; 4471 4471 } 4472 4472 4473 - if ((flags & WMI_KEY_GROUP) && cmd == SET_KEY && is_ap_with_no_sta) 4473 + if (flags == WMI_KEY_GROUP && cmd == SET_KEY && is_ap_with_no_sta) 4474 4474 arvif->reinstall_group_keys = true; 4475 4475 } 4476 4476
+18 -16
drivers/net/wireless/ath/ath12k/mac.c
··· 8290 8290 wake_up(&ar->txmgmt_empty_waitq); 8291 8291 } 8292 8292 8293 - int ath12k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx) 8293 + static void ath12k_mac_tx_mgmt_free(struct ath12k *ar, int buf_id) 8294 8294 { 8295 - struct sk_buff *msdu = skb; 8295 + struct sk_buff *msdu; 8296 8296 struct ieee80211_tx_info *info; 8297 - struct ath12k *ar = ctx; 8298 - struct ath12k_base *ab = ar->ab; 8299 8297 8300 8298 spin_lock_bh(&ar->txmgmt_idr_lock); 8301 - idr_remove(&ar->txmgmt_idr, buf_id); 8299 + msdu = idr_remove(&ar->txmgmt_idr, buf_id); 8302 8300 spin_unlock_bh(&ar->txmgmt_idr_lock); 8303 - dma_unmap_single(ab->dev, ATH12K_SKB_CB(msdu)->paddr, msdu->len, 8301 + 8302 + if (!msdu) 8303 + return; 8304 + 8305 + dma_unmap_single(ar->ab->dev, ATH12K_SKB_CB(msdu)->paddr, msdu->len, 8304 8306 DMA_TO_DEVICE); 8305 8307 8306 8308 info = IEEE80211_SKB_CB(msdu); 8307 8309 memset(&info->status, 0, sizeof(info->status)); 8308 8310 8309 - ath12k_mgmt_over_wmi_tx_drop(ar, skb); 8311 + ath12k_mgmt_over_wmi_tx_drop(ar, msdu); 8312 + } 8313 + 8314 + int ath12k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx) 8315 + { 8316 + struct ath12k *ar = ctx; 8317 + 8318 + ath12k_mac_tx_mgmt_free(ar, buf_id); 8310 8319 8311 8320 return 0; 8312 8321 } ··· 8324 8315 { 8325 8316 struct ieee80211_vif *vif = ctx; 8326 8317 struct ath12k_skb_cb *skb_cb = ATH12K_SKB_CB(skb); 8327 - struct sk_buff *msdu = skb; 8328 8318 struct ath12k *ar = skb_cb->ar; 8329 - struct ath12k_base *ab = ar->ab; 8330 8319 8331 - if (skb_cb->vif == vif) { 8332 - spin_lock_bh(&ar->txmgmt_idr_lock); 8333 - idr_remove(&ar->txmgmt_idr, buf_id); 8334 - spin_unlock_bh(&ar->txmgmt_idr_lock); 8335 - dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len, 8336 - DMA_TO_DEVICE); 8337 - } 8320 + if (skb_cb->vif == vif) 8321 + ath12k_mac_tx_mgmt_free(ar, buf_id); 8338 8322 8339 8323 return 0; 8340 8324 }
+1 -2
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
··· 5627 5627 *cookie, le16_to_cpu(action_frame->len), 5628 5628 le32_to_cpu(af_params->channel)); 5629 5629 5630 - ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg), 5631 - af_params); 5630 + ack = brcmf_p2p_send_action_frame(vif->ifp, af_params); 5632 5631 5633 5632 cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack, 5634 5633 GFP_KERNEL);
+10 -18
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
··· 1529 1529 /** 1530 1530 * brcmf_p2p_tx_action_frame() - send action frame over fil. 1531 1531 * 1532 + * @ifp: interface to transmit on. 1532 1533 * @p2p: p2p info struct for vif. 1533 1534 * @af_params: action frame data/info. 1534 1535 * ··· 1539 1538 * The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action 1540 1539 * frame is transmitted. 1541 1540 */ 1542 - static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p, 1541 + static s32 brcmf_p2p_tx_action_frame(struct brcmf_if *ifp, 1542 + struct brcmf_p2p_info *p2p, 1543 1543 struct brcmf_fil_af_params_le *af_params) 1544 1544 { 1545 1545 struct brcmf_pub *drvr = p2p->cfg->pub; 1546 - struct brcmf_cfg80211_vif *vif; 1547 - struct brcmf_p2p_action_frame *p2p_af; 1548 1546 s32 err = 0; 1549 1547 1550 1548 brcmf_dbg(TRACE, "Enter\n"); ··· 1552 1552 clear_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, &p2p->status); 1553 1553 clear_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status); 1554 1554 1555 - /* check if it is a p2p_presence response */ 1556 - p2p_af = (struct brcmf_p2p_action_frame *)af_params->action_frame.data; 1557 - if (p2p_af->subtype == P2P_AF_PRESENCE_RSP) 1558 - vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif; 1559 - else 1560 - vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif; 1561 - 1562 - err = brcmf_fil_bsscfg_data_set(vif->ifp, "actframe", af_params, 1555 + err = brcmf_fil_bsscfg_data_set(ifp, "actframe", af_params, 1563 1556 sizeof(*af_params)); 1564 1557 if (err) { 1565 1558 bphy_err(drvr, " sending action frame has failed\n"); ··· 1704 1711 /** 1705 1712 * brcmf_p2p_send_action_frame() - send action frame . 1706 1713 * 1707 - * @cfg: driver private data for cfg80211 interface. 1708 - * @ndev: net device to transmit on. 1714 + * @ifp: interface to transmit on. 1709 1715 * @af_params: configuration data for action frame. 1710 1716 */ 1711 - bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg, 1712 - struct net_device *ndev, 1717 + bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp, 1713 1718 struct brcmf_fil_af_params_le *af_params) 1714 1719 { 1720 + struct brcmf_cfg80211_info *cfg = ifp->drvr->config; 1715 1721 struct brcmf_p2p_info *p2p = &cfg->p2p; 1716 - struct brcmf_if *ifp = netdev_priv(ndev); 1717 1722 struct brcmf_fil_action_frame_le *action_frame; 1718 1723 struct brcmf_config_af_params config_af_params; 1719 1724 struct afx_hdl *afx_hdl = &p2p->afx_hdl; ··· 1848 1857 if (af_params->channel) 1849 1858 msleep(P2P_AF_RETRY_DELAY_TIME); 1850 1859 1851 - ack = !brcmf_p2p_tx_action_frame(p2p, af_params); 1860 + ack = !brcmf_p2p_tx_action_frame(ifp, p2p, af_params); 1852 1861 tx_retry++; 1853 1862 dwell_overflow = brcmf_p2p_check_dwell_overflow(requested_dwell, 1854 1863 dwell_jiffies); ··· 2208 2217 2209 2218 WARN_ON(p2p_ifp->bsscfgidx != bsscfgidx); 2210 2219 2211 - init_completion(&p2p->send_af_done); 2212 2220 INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler); 2213 2221 init_completion(&p2p->afx_hdl.act_frm_scan); 2214 2222 init_completion(&p2p->wait_next_af); ··· 2502 2512 2503 2513 pri_ifp = brcmf_get_ifp(cfg->pub, 0); 2504 2514 p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif = pri_ifp->vif; 2515 + 2516 + init_completion(&p2p->send_af_done); 2505 2517 2506 2518 if (p2pdev_forced) { 2507 2519 err_ptr = brcmf_p2p_create_p2pdev(p2p, NULL, NULL);
+1 -2
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
··· 168 168 int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp, 169 169 const struct brcmf_event_msg *e, 170 170 void *data); 171 - bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg, 172 - struct net_device *ndev, 171 + bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp, 173 172 struct brcmf_fil_af_params_le *af_params); 174 173 bool brcmf_p2p_scan_finding_common_channel(struct brcmf_cfg80211_info *cfg, 175 174 struct brcmf_bss_info_le *bi);
+3 -2
drivers/net/wireless/intel/iwlwifi/mld/link.c
··· 501 501 struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(bss_conf->vif); 502 502 struct iwl_mld_link *link = iwl_mld_link_from_mac80211(bss_conf); 503 503 bool is_deflink = link == &mld_vif->deflink; 504 + u8 fw_id = link->fw_id; 504 505 505 506 if (WARN_ON(!link || link->active)) 506 507 return; ··· 514 513 515 514 RCU_INIT_POINTER(mld_vif->link[bss_conf->link_id], NULL); 516 515 517 - if (WARN_ON(link->fw_id >= mld->fw->ucode_capa.num_links)) 516 + if (WARN_ON(fw_id >= mld->fw->ucode_capa.num_links)) 518 517 return; 519 518 520 - RCU_INIT_POINTER(mld->fw_id_to_bss_conf[link->fw_id], NULL); 519 + RCU_INIT_POINTER(mld->fw_id_to_bss_conf[fw_id], NULL); 521 520 } 522 521 523 522 void iwl_mld_handle_missed_beacon_notif(struct iwl_mld *mld,
+3
net/mac80211/cfg.c
··· 1876 1876 link_conf->nontransmitted = false; 1877 1877 link_conf->ema_ap = false; 1878 1878 link_conf->bssid_indicator = 0; 1879 + link_conf->fils_discovery.min_interval = 0; 1880 + link_conf->fils_discovery.max_interval = 0; 1881 + link_conf->unsol_bcast_probe_resp_interval = 0; 1879 1882 1880 1883 __sta_info_flush(sdata, true, link_id, NULL); 1881 1884
+8 -3
net/mac80211/key.c
··· 508 508 ret = ieee80211_key_enable_hw_accel(new); 509 509 } 510 510 } else { 511 - if (!new->local->wowlan) 511 + if (!new->local->wowlan) { 512 512 ret = ieee80211_key_enable_hw_accel(new); 513 - else if (link_id < 0 || !sdata->vif.active_links || 514 - BIT(link_id) & sdata->vif.active_links) 513 + } else if (link_id < 0 || !sdata->vif.active_links || 514 + BIT(link_id) & sdata->vif.active_links) { 515 515 new->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE; 516 + if (!(new->conf.flags & (IEEE80211_KEY_FLAG_GENERATE_MMIC | 517 + IEEE80211_KEY_FLAG_PUT_MIC_SPACE | 518 + IEEE80211_KEY_FLAG_RESERVE_TAILROOM))) 519 + decrease_tailroom_need_count(sdata, 1); 520 + } 516 521 } 517 522 518 523 if (ret)
+1 -2
net/wireless/nl80211.c
··· 4136 4136 rdev->wiphy.txq_quantum = old_txq_quantum; 4137 4137 } 4138 4138 4139 - if (old_rts_threshold) 4140 - kfree(old_radio_rts_threshold); 4139 + kfree(old_radio_rts_threshold); 4141 4140 return result; 4142 4141 } 4143 4142