linux-toradex.git/drivers/net/wireless/ath/carl9170, branch master Linux kernel for Apalis and Colibri modules Merge tag 'wireless-2026-07-26' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next 2026-07-27T23:03:40+00:00 Jakub Kicinski kuba@kernel.org 2026-07-27T23:01:11+00:00 edc84a9396acf1a0e78c46230dd0bcee1b84ac53 Johannes Berg says: ==================== wireless-next-2026-07-26 Mostly driver changes this time: - new driver mm81x for an S1G device - new driver nxpwifi for NXP devices (mostly forked off from mwifiex) - ath12k: much kernel infrastructure integration work - brcmfmac: DPP support, some Cypress part update - nl80211: per-link statistics support ==================== Link: https://patch.msgid.link/20260726105205.942922-60-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org> 
Johannes Berg says:

====================
wireless-next-2026-07-26

Mostly driver changes this time:
 - new driver mm81x for an S1G device
 - new driver nxpwifi for NXP devices
   (mostly forked off from mwifiex)
 - ath12k: much kernel infrastructure integration work
 - brcmfmac: DPP support, some Cypress part update
 - nl80211: per-link statistics support
====================

Link: https://patch.msgid.link/20260726105205.942922-60-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
wifi: carl9170: cmd: downgrade transient register I/O errors to wiphy_dbg 2026-07-22T16:02:19+00:00 Masi Osmani mas-i@hotmail.de 2026-03-17T11:06:34+00:00 89f3630439f1555db4f12b98775c0399195d5027 Register read/write failures during deauth/teardown transitions are harmless — mac80211 tries to read survey stats or write slot_time while the firmware is in a transitional state. The command times out with -EIO but the adapter recovers and re-authenticates normally. Downgrade both "writing reg ... failed" and "reading regs failed" from wiphy_err to wiphy_dbg to reduce dmesg noise. The errors are still visible with dynamic debug enabled for investigation. Signed-off-by: Masi Osmani <mas-i@hotmail.de> Acked-by: Christian Lamparter <chunkeey@gmail.com> Link: https://patch.msgid.link/AM7PPF5613FA0B67FB95CB5305CEF9DAA209441A@AM7PPF5613FA0B6.EURP251.PROD.OUTLOOK.COM Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> 
Register read/write failures during deauth/teardown transitions are
harmless — mac80211 tries to read survey stats or write slot_time
while the firmware is in a transitional state.  The command times
out with -EIO but the adapter recovers and re-authenticates normally.

Downgrade both "writing reg ... failed" and "reading regs failed"
from wiphy_err to wiphy_dbg to reduce dmesg noise.  The errors are
still visible with dynamic debug enabled for investigation.

Signed-off-by: Masi Osmani <mas-i@hotmail.de>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Link: https://patch.msgid.link/AM7PPF5613FA0B67FB95CB5305CEF9DAA209441A@AM7PPF5613FA0B6.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: carl9170: rx: track PHY errors via debugfs 2026-07-22T16:02:19+00:00 Masi Osmani mas-i@hotmail.de 2026-03-12T10:38:00+00:00 2ac1d4de8e5113b8b40bd22374ff51a5cd95dd9e Count PHY errors reported by the hardware in the RX status and expose the counter through debugfs as rx_phy_errors. Previously, PHY errors from ar9170_rx_phystatus were silently ignored (marked with a TODO comment). The counter helps diagnose RF environment issues (interference, multipath, low SNR) without requiring monitor mode or additional tooling. Signed-off-by: Masi Osmani <mas-i@hotmail.de> Acked-by: Christian Lamparter <chunkeey@gmail.com> Link: https://patch.msgid.link/AM7PPF5613FA0B6B42814E38096301FE9429444A@AM7PPF5613FA0B6.EURP251.PROD.OUTLOOK.COM Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> 
Count PHY errors reported by the hardware in the RX status and
expose the counter through debugfs as rx_phy_errors.  Previously,
PHY errors from ar9170_rx_phystatus were silently ignored (marked
with a TODO comment).

The counter helps diagnose RF environment issues (interference,
multipath, low SNR) without requiring monitor mode or additional
tooling.

Signed-off-by: Masi Osmani <mas-i@hotmail.de>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Link: https://patch.msgid.link/AM7PPF5613FA0B6B42814E38096301FE9429444A@AM7PPF5613FA0B6.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: carl9170: mac80211: document spatial multiplexing power save handler 2026-07-22T16:02:19+00:00 Masi Osmani mas-i@hotmail.de 2026-03-12T10:37:58+00:00 a711bf00b8b3c6d879cb5d95bbe921366228b318 Replace the bare TODO comment in the SMPS configuration handler with documentation explaining why the driver accepts but does not act on SMPS mode changes. The AR9170 advertises SM_PS disabled (both chains always active) in its HT capabilities. While mac80211 may still send SMPS configuration requests, implementing static or dynamic SMPS would require firmware support for per-chain enable/disable that the AR9170 firmware (v1.9.9) does not provide. Signed-off-by: Masi Osmani <mas-i@hotmail.de> Acked-by: Christian Lamparter <chunkeey@gmail.com> Link: https://patch.msgid.link/AM7PPF5613FA0B6B76223A73FFC756A19A99444A@AM7PPF5613FA0B6.EURP251.PROD.OUTLOOK.COM Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> 
Replace the bare TODO comment in the SMPS configuration handler
with documentation explaining why the driver accepts but does not
act on SMPS mode changes.

The AR9170 advertises SM_PS disabled (both chains always active)
in its HT capabilities.  While mac80211 may still send SMPS
configuration requests, implementing static or dynamic SMPS would
require firmware support for per-chain enable/disable that the
AR9170 firmware (v1.9.9) does not provide.

Signed-off-by: Masi Osmani <mas-i@hotmail.de>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Link: https://patch.msgid.link/AM7PPF5613FA0B6B76223A73FFC756A19A99444A@AM7PPF5613FA0B6.EURP251.PROD.OUTLOOK.COM
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: carl9170: fix buffer overflow in rx_stream failover path 2026-07-13T13:55:20+00:00 Tristan Madani tristan@talencesecurity.com 2026-04-21T13:49:28+00:00 a1a21995c2e1cc2ca6b2226cfe4f5f018370182a The failover continuation in carl9170_rx_stream() copies the full tlen from the second USB transfer instead of capping at rx_failover_missing bytes. When both transfers are near maximum size, the total exceeds the 65535-byte failover SKB, triggering skb_over_panic. Limit the copy size to the missing byte count. Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend") Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Acked-by: Christian Lamparter <chunkeey@gmail.com> Closes: https://syzkaller.appspot.com/bug?extid=5c1ca6ccaa1215781cac Link: https://patch.msgid.link/20260421134929.325662-4-tristmd@gmail.com [Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT] Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> 
The failover continuation in carl9170_rx_stream() copies the full tlen
from the second USB transfer instead of capping at rx_failover_missing
bytes. When both transfers are near maximum size, the total exceeds the
65535-byte failover SKB, triggering skb_over_panic.

Limit the copy size to the missing byte count.

Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=5c1ca6ccaa1215781cac
Link: https://patch.msgid.link/20260421134929.325662-4-tristmd@gmail.com
[Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT]
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: carl9170: fix OOB read from off-by-two in TX status handler 2026-07-13T13:55:19+00:00 Tristan Madani tristan@talencesecurity.com 2026-04-21T13:49:27+00:00 a3f42f1049ad80c65560d2b078ad426c3134f78d The bounds check in carl9170_tx_process_status() uses `i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing 2 extra iterations past valid _tx_status entries when the firmware- controlled hdr.ext exceeds hdr.len/2. Fix by using the correct comparison `i >= (cmd->hdr.len / 2)`. Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend") Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Acked-by: Christian Lamparter <chunkeey@gmail.com> Closes: https://syzkaller.appspot.com/bug?extid=5c1ca6ccaa1215781cac Link: https://patch.msgid.link/20260421134929.325662-3-tristmd@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> 
The bounds check in carl9170_tx_process_status() uses
`i > ((cmd->hdr.len / 2) + 1)` which is off by two, allowing
2 extra iterations past valid _tx_status entries when the firmware-
controlled hdr.ext exceeds hdr.len/2. Fix by using the correct
comparison `i >= (cmd->hdr.len / 2)`.

Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=5c1ca6ccaa1215781cac
Link: https://patch.msgid.link/20260421134929.325662-3-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read 2026-07-13T13:55:19+00:00 Tristan Madani tristan@talencesecurity.com 2026-04-21T13:49:26+00:00 4cde55b2feff9504d1f993ab80e84e7ccb62791c When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart() but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4). Since len comes from the firmware and can exceed ar->readlen, this copies more data than the readbuf was allocated for. Bound the memcpy to min(len - 4, ar->readlen) so that the response is still completed -- avoiding repeated restarts from queued garbage -- while preventing an overread past the response buffer. Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend") Signed-off-by: Tristan Madani <tristan@talencesecurity.com> Acked-by: Christian Lamparter <chunkeey@gmail.com> Closes: https://syzkaller.appspot.com/bug?extid=5c1ca6ccaa1215781cac Link: https://patch.msgid.link/20260421134929.325662-2-tristmd@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> 
When the firmware sends a command response with a length mismatch,
carl9170_cmd_callback() logs the mismatch and calls carl9170_restart()
but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4).
Since len comes from the firmware and can exceed ar->readlen, this
copies more data than the readbuf was allocated for.

Bound the memcpy to min(len - 4, ar->readlen) so that the response
is still completed -- avoiding repeated restarts from queued garbage --
while preventing an overread past the response buffer.

Fixes: a84fab3cbfdc ("carl9170: 802.11 rx/tx processing and usb backend")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=5c1ca6ccaa1215781cac
Link: https://patch.msgid.link/20260421134929.325662-2-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-22T01:09:51+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-02-22T00:37:42+00:00 bf4afc53b77aeaa48b5409da5c8da6bb4eff7f43 This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
This was done entirely with mindless brute force, using

    git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
        xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'

to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.

Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.

For the same reason the 'flex' versions will be done as a separate
conversion.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21T09:02:28+00:00 Kees Cook kees@kernel.org 2026-02-21T07:49:23+00:00 69050f8d6d075dc01af7a5f2f550a8067510366f This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org> 
This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook <kees@kernel.org>
carl9170: Avoid -Wflex-array-member-not-at-end warning 2026-01-17T19:00:37+00:00 Gustavo A. R. Silva gustavoars@kernel.org 2025-11-19T07:33:26+00:00 cd8da637106d6a1924c0d6dd05e8ee932ef234b5 -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Move the conflicting declaration (which happens to be in a union, so we're moving the entire union) to the end of the corresponding structure. Notice that `struct carl9170_rsp` is a flexible structure, this is a structure that contains a flexible-array member. With these changes fix the following warning: drivers/net/wireless/ath/carl9170/carl9170.h:382:9: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Acked-by: Christian Lamparter <chunkeey@gmail.com> Link: https://patch.msgid.link/aR1yxjmzb2DM2-Uq@kspp Signed-off-by: Kees Cook <kees@kernel.org> 
-Wflex-array-member-not-at-end was introduced in GCC-14, and we are
getting ready to enable it, globally.

Move the conflicting declaration (which happens to be in a union, so
we're moving the entire union) to the end of the corresponding
structure. Notice that `struct carl9170_rsp` is a flexible structure,
this is a structure that contains a flexible-array member.

With these changes fix the following warning:

drivers/net/wireless/ath/carl9170/carl9170.h:382:9: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Link: https://patch.msgid.link/aR1yxjmzb2DM2-Uq@kspp
Signed-off-by: Kees Cook <kees@kernel.org>