linux-toradex.git/drivers/net/wireless/realtek/rtlwifi, branch master

wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor

2026-04-29T05:50:55+00:00

Bit 28 of double word 2 in the RX descriptor indicates if the packet is
a normal 802.11 frame, or a message from the wifi firmware to the
driver (Card 2 Host).

Commit f5678bfe1cdc ("rtlwifi: rtl8821ae: Replace local bit manipulation
macros") mistakenly made the driver look for this bit in double word 1,
causing packet loss and Bluetooth coexistence problems.

Fixes: f5678bfe1cdc ("rtlwifi: rtl8821ae: Replace local bit manipulation macros")
Cc: 
Signed-off-by: Bitterblue Smith 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/04da7398-cedb-425a-a810-5772ab10139d@gmail.com

wifi: rtlwifi: fix typos in comments in rtl8821ae_card_disable()

2026-04-29T03:13:25+00:00

Fix typos in rtl8821ae_card_disable() comments.

Signed-off-by: Hugo Villeneuve 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260417200520.3919437-1-hugo@hugovil.com

wifi: rtlwifi: validate action frame size before using in _rtl_pci_tx_isr()

2026-04-29T03:01:06+00:00

Since TX action frames might be malformed, validate the size before using.

Tested on RTL8723BE.

Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260414062229.21047-4-pkshih@realtek.com

wifi: rtlwifi: validate action frame size in rtl_action_proc()

2026-04-29T03:00:55+00:00

Since action frames might be malformed from RX or injected TX, validate
the size before using.

More, use struct ieee80211_mgmt to access fields of action frames instead
of counting barely.

Tested with ping on RTL8723BE. The add BA request action frames of TX/RX
can be handled properly.

Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260414062229.21047-3-pkshih@realtek.com

wifi: rtlwifi: rtl8821ae: Remove dead code in rtl8821ae_update_hal_rate_table()

2026-04-29T02:53:50+00:00

The variable 'mimo_ps' is initialized to IEEE80211_SMPS_OFF and never
modified throughout the function. This makes the condition checking for
IEEE80211_SMPS_STATIC always evaluate to false, rendering the entire
if-branch unreachable dead code.

The error was reported by Coverity Scan.

Signed-off-by: Chelsy Ratnawat 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260407123427.14612-1-chelsyratnawat2001@gmail.com

Merge tag 'rtw-next-2026-04-02' of https://github.com/pkshih/rtw into wireless-next

2026-04-07T14:20:55+00:00

Ping-Ke Shih says:
==================
rtw-next patches for -next

Improve MLO and some random fixes. Notable changes are:

 * drop usb device reference across drivers

rtw89:

 * add RTL8922DE but not enabled yet, because BT coexistence is still
   cooking.

 * add USB RX aggregation to improve performance.

 * add USB TX flow control by tracking in-flight URBs.
==================

Signed-off-by: Johannes Berg

wifi: rtlwifi: rtl8192d: fix typo in H2C wait counter names

2026-03-16T06:10:04+00:00

Rename local variables in rtl92d_fill_h2c_cmd()
from wait_writeh2c_limmit/wait_h2c_limmit
to wait_writeh2c_limit/wait_h2c_limit.

No functional change.

Signed-off-by: Jaime Saguillo Revilla 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260308111850.20420-1-jaime.saguillo@gmail.com

wifi: rtlwifi: usb: drop redundant device reference

2026-03-16T06:06:11+00:00

Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.

Drop the redundant device reference to reduce cargo culting, make it
easier to spot drivers where an extra reference is needed, and reduce
the risk of memory leaks when drivers fail to release it.

Signed-off-by: Johan Hovold 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260309083336.16397-1-johan@kernel.org

wifi: move action code from per-type frame structs

2026-03-06T09:36:26+00:00

The action code actually serves to identify the type of action
frame, so it really isn't part of the per-type structure. Pull
it out and have it in the general action frame format.

In theory, whether or not the action code is present in this
way is up to each category, but all categories that are defined
right now all have that value.

While at it, and since this change requires changing all users,
remove the 'u' and make it an anonymous union in this case, so
that all code using this changes.

Change IEEE80211_MIN_ACTION_SIZE to take an argument which says
how much of the frame is needed, e.g. category, action_code or
the specific frame type that's defined in the union. Again this
also ensures that all code is updated.

In some cases, fix bugs where the SKB length was checked after
having accessed beyond the checked length, in particular in FTM
code, e.g. ieee80211_is_ftm().

Link: https://patch.msgid.link/20260226183607.67e71846b59e.I9a24328e3ffcaae179466a935f1c3345029f9961@changeid
Signed-off-by: Johannes Berg

wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet

2026-03-03T02:56:05+00:00

The irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and
scheduled when RTL_IMR_BCNINT interrupt is triggered by hardware.
But it is never killed in rtl_pci_deinit(). When the rtlwifi card
probe fails or is being detached, the ieee80211_hw is deallocated.
However, irq_prepare_bcn_tasklet may still be running or pending,
leading to use-after-free when the freed ieee80211_hw is accessed
in _rtl_pci_prepare_bcn_tasklet().

Similar to irq_tasklet, add tasklet_kill() in rtl_pci_deinit() to
ensure that irq_prepare_bcn_tasklet is properly terminated before
the ieee80211_hw is released.

The issue was identified through static analysis.

Fixes: 0c8173385e54 ("rtl8192ce: Add new driver")
Signed-off-by: Duoming Zhou 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260223045522.48377-1-duoming@zju.edu.cn