linux-toradex.git/drivers/net/wireless/ath, branch master Linux kernel for Apalis and Colibri modules Merge tag 'wireless-2026-09-16' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless 2026-09-16T22:54:56+00:00 Jakub Kicinski kuba@kernel.org 2026-09-16T22:54:55+00:00 fefaac1176bf3cf002a8dc83339d6ed6a369941a Johannes Berg says: ==================== Many fixes: - mac80211: S1G TIM bitmap fix - ath12k: remove undocumented DT ABI implementation - various firmware API and over-the-air hardening changes - fixes for most cfg80211/mac80211 syzbot reports * tag 'wireless-2026-09-16' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (67 commits) wifi: brcmsmac: fix UAF in brcms_free_timer() wifi: brcmfmac: fix lost 802.1x TX completion wakeup wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wifi: ath12k: ahb: Revert undocumented ABI and dead code wifi: mac80211: refuse to make a monitor active when it has no queue wifi: libipw: reject TKIP frames without a full MIC wifi: virt_wifi: don't transfer operstate before register wifi: cfg80211: check if AP has been started or joined a mesh before adding new station wifi: cfg80211: move link_id validation earlier in nl80211_new_station() wifi: cfg80211: do not support direct add of station to AP_VLAN interfaces wifi: cfg80211: verify if AP_VLAN belongs to the correct AP wifi: mac80211: set up the TX info early to fix failure paths wifi: mac80211: mesh: release the channel if start fails wifi: mac80211: mesh: reset the CSA state when leaving wifi: mac80211: add HE 6 GHz capability in the scan elems len wifi: mac80211: don't access the TSF of a down interface wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set wifi: mac80211: don't allow link changes when iface is down wifi: mac80211: require a peer station for TDLS setup confirm ... ==================== Link: https://patch.msgid.link/20260916083642.110609-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org> 
Johannes Berg says:

====================
Many fixes:
 - mac80211: S1G TIM bitmap fix
 - ath12k: remove undocumented DT ABI implementation
 - various firmware API and over-the-air hardening changes
 - fixes for most cfg80211/mac80211 syzbot reports

* tag 'wireless-2026-09-16' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (67 commits)
  wifi: brcmsmac: fix UAF in brcms_free_timer()
  wifi: brcmfmac: fix lost 802.1x TX completion wakeup
  wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
  wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
  wifi: ath12k: ahb: Revert undocumented ABI and dead code
  wifi: mac80211: refuse to make a monitor active when it has no queue
  wifi: libipw: reject TKIP frames without a full MIC
  wifi: virt_wifi: don't transfer operstate before register
  wifi: cfg80211: check if AP has been started or joined a mesh before adding new station
  wifi: cfg80211: move link_id validation earlier in nl80211_new_station()
  wifi: cfg80211: do not support direct add of station to AP_VLAN interfaces
  wifi: cfg80211: verify if AP_VLAN belongs to the correct AP
  wifi: mac80211: set up the TX info early to fix failure paths
  wifi: mac80211: mesh: release the channel if start fails
  wifi: mac80211: mesh: reset the CSA state when leaving
  wifi: mac80211: add HE 6 GHz capability in the scan elems len
  wifi: mac80211: don't access the TSF of a down interface
  wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
  wifi: mac80211: don't allow link changes when iface is down
  wifi: mac80211: require a peer station for TDLS setup confirm
  ...
====================

Link: https://patch.msgid.link/20260916083642.110609-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() 2026-09-14T18:43:31+00:00 Nicolas Escande nico.escande@gmail.com 2026-07-31T14:58:30+00:00 820b8cff81c796ba20573e04722ab62500713f97 When mac80211 removes a sta, it calls .sta_state() which in turn calls ath11k_mac_station_remove(). In that function we clean up both peers & arsta related resources. But when the firmware crashes, ath11k calls ieee80211_restart_hw(), which assumes that all driver related resources are cleaned up beforehand. This cleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not in fact free arsta->rx_stats / tx_stats. Extract the arsta cleanup from ath11k_mac_station_remove() into a new ath11k_mac_station_cleanup() and call it from both there and ath11k_mac_peer_cleanup_all(). This should handle kmemleaks reports like: unreferenced object 0xffffff801ae66400 (size 1024): comm "hostapd", pid 1306, jiffies 4295011565 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc d61c08ec): kmemleak_alloc+0x3c/0x50 __kmalloc_cache_noprof+0x2b0/0x3e0 ath11k_mac_op_sta_state+0x1dc/0xb10 drv_sta_state+0xac/0x6f8 sta_info_insert_rcu+0x314/0x5e0 sta_info_insert+0x14/0x38 ieee80211_add_station+0x10c/0x1a0 nl80211_new_station+0x3e8/0x680 genl_family_rcv_msg_doit+0xc0/0x120 genl_rcv_msg+0x1b4/0x258 netlink_rcv_skb+0x4c/0x108 genl_rcv+0x38/0x60 netlink_unicast+0x190/0x278 netlink_sendmsg+0x15c/0x370 ____sys_sendmsg+0x120/0x290 ___sys_sendmsg+0x70/0xa0 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1 Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Nicolas Escande <nico.escande@gmail.com> Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20260731145830.769811-1-nico.escande@gmail.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> 
When mac80211 removes a sta, it calls .sta_state() which in turn calls
ath11k_mac_station_remove(). In that function we clean up both peers &
arsta related resources.

But when the firmware crashes, ath11k calls ieee80211_restart_hw(), which
assumes that all driver related resources are cleaned up beforehand. This
cleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not
in fact free arsta->rx_stats / tx_stats.

Extract the arsta cleanup from ath11k_mac_station_remove() into a
new ath11k_mac_station_cleanup() and call it from both there and
ath11k_mac_peer_cleanup_all().

This should handle kmemleaks reports like:
	unreferenced object 0xffffff801ae66400 (size 1024):
	  comm "hostapd", pid 1306, jiffies 4295011565
	  hex dump (first 32 bytes):
	    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
	    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
	  backtrace (crc d61c08ec):
	    kmemleak_alloc+0x3c/0x50
	    __kmalloc_cache_noprof+0x2b0/0x3e0
	    ath11k_mac_op_sta_state+0x1dc/0xb10
	    drv_sta_state+0xac/0x6f8
	    sta_info_insert_rcu+0x314/0x5e0
	    sta_info_insert+0x14/0x38
	    ieee80211_add_station+0x10c/0x1a0
	    nl80211_new_station+0x3e8/0x680
	    genl_family_rcv_msg_doit+0xc0/0x120
	    genl_rcv_msg+0x1b4/0x258
	    netlink_rcv_skb+0x4c/0x108
	    genl_rcv+0x38/0x60
	    netlink_unicast+0x190/0x278
	    netlink_sendmsg+0x15c/0x370
	    ____sys_sendmsg+0x120/0x290
	    ___sys_sendmsg+0x70/0xa0

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Nicolas Escande <nico.escande@gmail.com>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20260731145830.769811-1-nico.escande@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown 2026-09-14T18:43:30+00:00 Fan Wu fanwu01@zju.edu.cn 2026-09-10T02:09:07+00:00 d9be5e75530772fc31637070d51e5717d6aeaa2a wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(), which only dequeues the timer and does not wait for a callback that is already executing; the preceding free_irq() calls synchronize the interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can therefore be running past the teardown and use the wcn freed along with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock, reads wcn->tx_ack_skb and passes wcn->hw to ieee80211_tx_status_irqsafe(). Fix this by using timer_shutdown_sync(), which waits for a running callback and also prevents the timer from being rearmed again. The timer is set up again by wcn36xx_dxe_init() on the next start, so the start/stop cycle is unaffected. This issue was found by an in-house static analysis tool. Fixes: fdf21cc37149 ("wcn36xx: Add TX ack support") Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Song Li <songl@zju.edu.cn> Signed-off-by: Song Li <songl@zju.edu.cn> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Link: https://patch.msgid.link/20260910020907.3353-1-fanwu01@zju.edu.cn Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> 
wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(),
which only dequeues the timer and does not wait for a callback that is
already executing; the preceding free_irq() calls synchronize the
interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can
therefore be running past the teardown and use the wcn freed along
with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock,
reads wcn->tx_ack_skb and passes wcn->hw to
ieee80211_tx_status_irqsafe().

Fix this by using timer_shutdown_sync(), which waits for a running
callback and also prevents the timer from being rearmed again. The
timer is set up again by wcn36xx_dxe_init() on the next start, so the
start/stop cycle is unaffected.

This issue was found by an in-house static analysis tool.

Fixes: fdf21cc37149 ("wcn36xx: Add TX ack support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260910020907.3353-1-fanwu01@zju.edu.cn
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath12k: ahb: Revert undocumented ABI and dead code 2026-09-14T18:43:30+00:00 Krzysztof Kozlowski krzysztof.kozlowski@oss.qualcomm.com 2026-08-25T08:13:14+00:00 ce9d5197d651cdd0fbb586c3d77c28438abe1b10 Commit 96f46607bbce ("wifi: ath12k: add AHB platform descriptor support") added undocumented OF ABI, by relying on a very specific node name. This is not allowed and was never acked by Devicetree maintainers. Additionally that part of code is not even used, because all devices have exactly the same user pd, so this was added "for future". Adding dead code just "for future" is heavily discouraged in kernel coding. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260825081313.71351-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> 
Commit 96f46607bbce ("wifi: ath12k: add AHB platform descriptor
support") added undocumented OF ABI, by relying on a very specific node
name.  This is not allowed and was never acked by Devicetree
maintainers.

Additionally that part of code is not even used, because all devices
have exactly the same user pd, so this was added "for future".  Adding
dead code just "for future" is heavily discouraged in kernel coding.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260825081313.71351-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
treewide: refresh kmalloc_obj() conversions 2026-09-05T04:37:00+00:00 Kees Cook kees+treewide@kernel.org 2026-09-02T22:31:14+00:00 3a2c4d55e32ad65efebdb6de44eef3bfa08bb49d This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook <kees+treewide@kernel.org> 
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci

This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.

Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.

Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
Merge tag 'pwrseq-updates-for-v7.3-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux 2026-08-26T15:45:09+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-26T15:45:09+00:00 a5218c6474df97f2e7f3af15dcdfc674bae5c137 Pull another power sequencing update from Bartosz Golaszewski: "A single tree-wide rename of two of the public functions to better reflect their actual semantics: - rename pwrseq_power_on/off() to pwrseq_enable/disable() tree-wide" * tag 'pwrseq-updates-for-v7.3-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: power: sequencing: rename pwrseq_power_on/off() to pwrseq_enable/disable() 
Pull another power sequencing update from Bartosz Golaszewski:
 "A single tree-wide rename of two of the public functions to better
  reflect their actual semantics:

   - rename pwrseq_power_on/off() to pwrseq_enable/disable() tree-wide"

* tag 'pwrseq-updates-for-v7.3-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  power: sequencing: rename pwrseq_power_on/off() to pwrseq_enable/disable()
power: sequencing: rename pwrseq_power_on/off() to pwrseq_enable/disable() 2026-08-26T08:05:45+00:00 Bartosz Golaszewski bartosz.golaszewski@oss.qualcomm.com 2026-07-31T13:42:18+00:00 d51fc9d4cd6eb18ac82913d83ecf7bd8c85f71ee The way power sequencing works means that a call to pwrseq_power_on() does not necessarily result in the pwrseq target being powered-on at that time: it may have already been powered on before. Similarly: a call to pwrseq_power_off() does not have to result in an actual powering off of resources: there may still be other users that requested a power-on before. We will also introduce the concept of "non-controllable" pwrseq targets soon which further increases the disconnect between the naming convention and the actual semantics. What consumers of pwrseq descriptors actually do is: they *vote* for a powering on of a given target or retract that vote. These operations could be called get/put in line with runtime PM but this could become confusing since we already provide pwrseq_get/put() for a different purpose. pwrseq_vote_on/off() also have been rejected as unusual in the tree. Change the name of the two functions to pwrseq_enable/disable() which better reflects their purpose and semantics and also mirrors other enable-counted resources like regulators and clocks. No functional change intended. If at any point users need to know *when* the exact power event happens, we can provide that information in the form of a notifier. Acked-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Acked-by: Alessio Belle <alessio.belle@imgtec.com> # imagination Link: https://patch.msgid.link/20260731-pwrseq-vote-rename-v3-1-44e60b8be053@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> 
The way power sequencing works means that a call to pwrseq_power_on()
does not necessarily result in the pwrseq target being powered-on at
that time: it may have already been powered on before. Similarly: a call
to pwrseq_power_off() does not have to result in an actual powering off
of resources: there may still be other users that requested a power-on
before.

We will also introduce the concept of "non-controllable" pwrseq targets
soon which further increases the disconnect between the naming
convention and the actual semantics.

What consumers of pwrseq descriptors actually do is: they *vote* for a
powering on of a given target or retract that vote. These operations
could be called get/put in line with runtime PM but this could become
confusing since we already provide pwrseq_get/put() for a different
purpose. pwrseq_vote_on/off() also have been rejected as unusual in
the tree.

Change the name of the two functions to pwrseq_enable/disable() which
better reflects their purpose and semantics and also mirrors other
enable-counted resources like regulators and clocks. No functional change
intended.

If at any point users need to know *when* the exact power event happens,
we can provide that information in the form of a notifier.

Acked-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Acked-by: Alessio Belle <alessio.belle@imgtec.com> # imagination
Link: https://patch.msgid.link/20260731-pwrseq-vote-rename-v3-1-44e60b8be053@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Merge tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 2026-08-25T17:44:46+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-25T17:44:46+00:00 f4d50813c0958b7d6bc79a7e0a77193372cbfd03 Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1. Lots of driver work for new devices and systems, and many other minor fixes and updates. Included in here are: - Thunderbolt subsystem driver updates and additions - typec driver updates and additions - usb gadget fixes all over the place, seems like people are finally paying attention to these drivers for some reason - xhci driver updates and fixes based on lots of reports - usb-serial driver updates and additions - new device ids - other minor USB driver updates and fixes All of these have been in linux-next for a while with no reported issues" * tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (163 commits) usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() usb: typec: hd3ss3220: fix VBUS regulator error message usb: usbfs: fix use-after-free of usb_device in usbdev_release() usb: gadget: u_audio: Fix use-after-free on sound card disconnect usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition usb: gadget: f_tcm: keep port count until LUN teardown completes usb: usbtest: disable dynamic ID support usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive() USB: c67x00: fix use-after-free in c67x00_add_iso_urb() usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion usb: gadget: snps_udc_plat: clean up PHY on probe deferral usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() usb: dwc2: gadget: Exit partial power down state when changing USB pull-up usb: gadget: f_fs: Fix Use-After-Free in AIO error path usb: gadget: f_fs: Prevent deadlock during ep0 read loop usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed usb: gadget: midi2: remove default configfs groups on teardown usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() usb: typec: thunderbolt: Disable work before freeing tbt on remove usb: xhci: Handle bogus TRB pointers in Missed Service Error events ... 
Pull USB / Thunderbolt updates from Greg KH:
 "Here is the big set of USB and Thunderbolt driver updates for 7.3-rc1.

  Lots of driver work for new devices and systems, and many other minor
  fixes and updates. Included in here are:

   - Thunderbolt subsystem driver updates and additions

   - typec driver updates and additions

   - usb gadget fixes all over the place, seems like people are finally
     paying attention to these drivers for some reason

   - xhci driver updates and fixes based on lots of reports

   - usb-serial driver updates and additions

   - new device ids

   - other minor USB driver updates and fixes

  All of these have been in linux-next for a while with no reported issues"

* tag 'usb-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (163 commits)
  usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
  usb: typec: hd3ss3220: fix VBUS regulator error message
  usb: usbfs: fix use-after-free of usb_device in usbdev_release()
  usb: gadget: u_audio: Fix use-after-free on sound card disconnect
  usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition
  usb: gadget: f_tcm: keep port count until LUN teardown completes
  usb: usbtest: disable dynamic ID support
  usb: typec: tcpci: pass correct rx_type to tcpm_pd_receive()
  USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
  usb: typec: ucsi: use UCSI_TIMEOUT_MS for sync command completion
  usb: gadget: snps_udc_plat: clean up PHY on probe deferral
  usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
  usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
  usb: gadget: f_fs: Fix Use-After-Free in AIO error path
  usb: gadget: f_fs: Prevent deadlock during ep0 read loop
  usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed
  usb: gadget: midi2: remove default configfs groups on teardown
  usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()
  usb: typec: thunderbolt: Disable work before freeing tbt on remove
  usb: xhci: Handle bogus TRB pointers in Missed Service Error events
  ...
Merge 7.2-rc7 into usb-next 2026-08-14T01:17:11+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2026-08-14T01:17:11+00:00 acbecf60145a2d6259ff3e059fd295cf626ed574 We need the USB fixes in here as well to build on top of. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
We need the USB fixes in here as well to build on top of.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge tag 'wireless-next-2026-08-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next 2026-08-06T19:39:11+00:00 Jakub Kicinski kuba@kernel.org 2026-08-06T19:39:10+00:00 4fa4977a0d900f936bcae5cd2c510be5554e8dd6 Johannes Berg says: ==================== Quite a bunch more work, of note: - iwlwifi: new FW version support - mt76: - mt7928 support - mt7925 NAN support - mt7996 AP powersave improvements - rtw89: - LED support - RTL8922DE support - dual-BT coex for RTL8922D - ath12k: AHB platform MultiPD support - cfg80211: pre-assign cookies for operations - mac80211: AQL support for multicast * tag 'wireless-next-2026-08-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (403 commits) wifi: nxpwifi: bound uAP association event IEs to the event buffer wifi: nxpwifi: detach sync command buffer on interrupted wait wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() wifi: rsi: Fix types to appease CFI wifi: mac80211: skip default WMM setup for AP_VLAN links wifi: nxpwifi: fix multiple static analysis errors and warnings wifi: morsemicro: MM81X should be invisible and selected by its users wifi: nxp: NXPWIFI should be invisible and selected by its users wifi: cfg80211: stop PMSR before P2P and NAN teardown wifi: mac80211: disconnect on CSA to channel 0 wifi: brcmfmac: fix P2P action frame handling without device vif wifi: brcmfmac: Set DMA direction for msgbuf packet IDs wifi: brcmfmac: validate msgbuf flowring IDs before use wifi: mac80211: fix RCU usage in peer probing wifi: mac80211: fix RCU dereference in throughput estimate wifi: wilc1000: validate monitor transmit frame headers wifi: mac80211: skip unused probe response countdown offsets wifi: zd1211rw: reject secondary interfaces to prevent conflicts wifi: nl80211: clean up color-change beacon data on errors wifi: mac80211: send TWT teardown to peer after setup TX failure ... ==================== Link: https://patch.msgid.link/20260806121304.190084-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org> 
Johannes Berg says:

====================
Quite a bunch more work, of note:
 - iwlwifi: new FW version support
 - mt76:
   - mt7928 support
   - mt7925 NAN support
   - mt7996 AP powersave improvements
 - rtw89:
   - LED support
   - RTL8922DE support
   - dual-BT coex for RTL8922D
 - ath12k: AHB platform MultiPD support
 - cfg80211: pre-assign cookies for operations
 - mac80211: AQL support for multicast

* tag 'wireless-next-2026-08-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (403 commits)
  wifi: nxpwifi: bound uAP association event IEs to the event buffer
  wifi: nxpwifi: detach sync command buffer on interrupted wait
  wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
  wifi: rsi: Fix types to appease CFI
  wifi: mac80211: skip default WMM setup for AP_VLAN links
  wifi: nxpwifi: fix multiple static analysis errors and warnings
  wifi: morsemicro: MM81X should be invisible and selected by its users
  wifi: nxp: NXPWIFI should be invisible and selected by its users
  wifi: cfg80211: stop PMSR before P2P and NAN teardown
  wifi: mac80211: disconnect on CSA to channel 0
  wifi: brcmfmac: fix P2P action frame handling without device vif
  wifi: brcmfmac: Set DMA direction for msgbuf packet IDs
  wifi: brcmfmac: validate msgbuf flowring IDs before use
  wifi: mac80211: fix RCU usage in peer probing
  wifi: mac80211: fix RCU dereference in throughput estimate
  wifi: wilc1000: validate monitor transmit frame headers
  wifi: mac80211: skip unused probe response countdown offsets
  wifi: zd1211rw: reject secondary interfaces to prevent conflicts
  wifi: nl80211: clean up color-change beacon data on errors
  wifi: mac80211: send TWT teardown to peer after setup TX failure
  ...
====================

Link: https://patch.msgid.link/20260806121304.190084-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>