linux-toradex.git/drivers/net/wireless, branch master

Merge tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-09-17T17:40:48+00:00

Pull networking fixes from Paolo Abeni:
 "Including fixes from Netfilter, Bluetooth, IPSec and WiFi.

  Previous releases - regressions:

   - netfilter: hold reference on ct until flow is released

   - bridge:
      - move switchdev call outside rcu
      - vlan: fix bugs caused by switchdev deletion errors

   - wifi:
      - mac80211: reset state when starting AP fails
      - cfg80211: don't free driver-owned scan requests

   - tcp: don't call skb_clone_and_charge_r() for close()d listener in
     tcp_v6_do_rcv()

   - mptcp: return sk_wait_data() errors from recvmsg()

   - xfrm: serialize state GC with device state flush

   - drop_monitor: synchronize tracepoint unregistration on error path

   - bluetooth:
      - eir: validate service data length before reading UUID
      - hci_sync: serialize local codec list cleanup
      - RFCOMM: avoid socket lock inversion in listener cleanup

   - eth:
      - lan743x: fix RX checksum use-after-free
      - mvpp2: prevent buffer overflow in page_pool allocation

  Previous releases - always broken:

   - core: lock the socket in sock_gettstamp()

   - neighbour: enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.

   - sched: codel: bound the dropping loop per dequeue call

   - wifi: mac80211: include TIM bitmap control for buffered S1G mcast
     traffic

   - psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()

   - xfrm: fix stack OOB read in iptfs_skb_reset_frag_walk()

   - bluetooth: hci_qca: do not write to the serial port after it is
     closed

   - dsa: mxl862xx: disable the stats poll on teardown

   - eth:
      - stmmac: fix TSO header length truncation
      - ip_tunnel: initialize `options_len` before referencing options"

* tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (159 commits)
  mptcp: fix bad accounting in __mptcp_subflow_push_pending()
  mptcp: close race between scheduler and state change
  mptcp: avoid unneeded actions on subflow reset
  net: skbuff: do not leave stale header offsets after pskb_carve()
  selftests: net: packetdrill: test exclusion of old ACK from TCP fast path
  tcp: exclude old ACKs from tcp fast path
  dpll: reject a reference sync pin which is not on the pin's dpll
  net: mvpp2: prevent buffer overflow in page_pool allocation
  net: macb: fix ordering around PTP timestamp read
  selftests: drv-net: psp: test PSP and TCP ULP mutual exclusion
  net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()
  net: stmmac: preserve real_num_tx_queues on mqprio setup failure
  net: stmmac: propagate FPE preemption-class mapping errors
  net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
  net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
  net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
  net: ethernet: cortina: Ack RX overrun interrupt correctly
  net: lock the socket in sock_gettstamp()
  eth: fbnic: ring the doorbell if a burst ends in a drop
  net: netsec: fix device_node reference leak on phy_np
  ...

Merge tag 'wireless-2026-09-16' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

2026-09-16T22:54:56+00:00

Johannes Berg says:

====================
Many fixes:
 - mac80211: S1G TIM bitmap fix
 - ath12k: remove undocumented DT ABI implementation
 - various firmware API and over-the-air hardening changes
 - fixes for most cfg80211/mac80211 syzbot reports

* tag 'wireless-2026-09-16' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (67 commits)
  wifi: brcmsmac: fix UAF in brcms_free_timer()
  wifi: brcmfmac: fix lost 802.1x TX completion wakeup
  wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
  wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
  wifi: ath12k: ahb: Revert undocumented ABI and dead code
  wifi: mac80211: refuse to make a monitor active when it has no queue
  wifi: libipw: reject TKIP frames without a full MIC
  wifi: virt_wifi: don't transfer operstate before register
  wifi: cfg80211: check if AP has been started or joined a mesh before adding new station
  wifi: cfg80211: move link_id validation earlier in nl80211_new_station()
  wifi: cfg80211: do not support direct add of station to AP_VLAN interfaces
  wifi: cfg80211: verify if AP_VLAN belongs to the correct AP
  wifi: mac80211: set up the TX info early to fix failure paths
  wifi: mac80211: mesh: release the channel if start fails
  wifi: mac80211: mesh: reset the CSA state when leaving
  wifi: mac80211: add HE 6 GHz capability in the scan elems len
  wifi: mac80211: don't access the TSF of a down interface
  wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
  wifi: mac80211: don't allow link changes when iface is down
  wifi: mac80211: require a peer station for TDLS setup confirm
  ...
====================

Link: https://patch.msgid.link/20260916083642.110609-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski

wifi: brcmsmac: fix UAF in brcms_free_timer()

2026-09-15T09:52:56+00:00

brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous
cancel_delayed_work() to cancel the timer's underlying delayed work.  If
the work callback (_brcms_timer) is already running, cancel_delayed_work()
returns false without waiting, and brcms_free_timer() proceeds to kfree(t)
while the callback still accesses t through container_of().

Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to
guarantee that any in-flight callback has completed before the timer
structure is freed.

Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi 
Acked-by: Arend van Spriel 
Link: https://patch.msgid.link/20260815121043.938414-1-yijiangshan@kylinos.cn
Signed-off-by: Johannes Berg

wifi: brcmfmac: fix lost 802.1x TX completion wakeup

2026-09-15T09:52:24+00:00

brcmf_txfinalize() decrements pend_8021x_cnt before a lockless
waitqueue_active() check. atomic_dec() does not order the decrement
against the check.

The waiter can therefore observe a nonzero count while the waker observes
an empty queue, losing the final wakeup and delaying key installation
until the 950 ms timeout.

Add smp_mb__after_atomic() to order the decrement before the queue
check. wait_event_timeout() provides the matching barrier. LKMM confirms
that this forbids the lost-wakeup outcome.

Fixes: 21fff75d2fb6 ("brcmfmac: use wait_event_timeout for 8021x pending count")
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter 
Acked-by: Arend van Spriel 
Link: https://patch.msgid.link/20260811082702.44521-1-kmehltretter@gmail.com
Signed-off-by: Johannes Berg

Merge tag 'ath-current-20260914' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath

2026-09-15T09:51:18+00:00

Jeff Johnson says:
==================
ath.git update for v7.3-rc4

In ath12k: revert an undocumented and unapproved DT ABI that was added
during the v7.3 merge window.

In wcn36xx and ath11k: fix preexisting object lifetime issues.
==================

Signed-off-by: Johannes Berg

wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()

2026-09-14T18:43:31+00:00

When mac80211 removes a sta, it calls .sta_state() which in turn calls
ath11k_mac_station_remove(). In that function we clean up both peers &
arsta related resources.

But when the firmware crashes, ath11k calls ieee80211_restart_hw(), which
assumes that all driver related resources are cleaned up beforehand. This
cleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not
in fact free arsta->rx_stats / tx_stats.

Extract the arsta cleanup from ath11k_mac_station_remove() into a
new ath11k_mac_station_cleanup() and call it from both there and
ath11k_mac_peer_cleanup_all().

This should handle kmemleaks reports like:
	unreferenced object 0xffffff801ae66400 (size 1024):
	  comm "hostapd", pid 1306, jiffies 4295011565
	  hex dump (first 32 bytes):
	    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
	    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
	  backtrace (crc d61c08ec):
	    kmemleak_alloc+0x3c/0x50
	    __kmalloc_cache_noprof+0x2b0/0x3e0
	    ath11k_mac_op_sta_state+0x1dc/0xb10
	    drv_sta_state+0xac/0x6f8
	    sta_info_insert_rcu+0x314/0x5e0
	    sta_info_insert+0x14/0x38
	    ieee80211_add_station+0x10c/0x1a0
	    nl80211_new_station+0x3e8/0x680
	    genl_family_rcv_msg_doit+0xc0/0x120
	    genl_rcv_msg+0x1b4/0x258
	    netlink_rcv_skb+0x4c/0x108
	    genl_rcv+0x38/0x60
	    netlink_unicast+0x190/0x278
	    netlink_sendmsg+0x15c/0x370
	    ____sys_sendmsg+0x120/0x290
	    ___sys_sendmsg+0x70/0xa0

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Nicolas Escande 
Reviewed-by: Rameshkumar Sundaram 
Reviewed-by: Baochen Qiang 
Link: https://patch.msgid.link/20260731145830.769811-1-nico.escande@gmail.com
Signed-off-by: Jeff Johnson

wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

2026-09-14T18:43:30+00:00

wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(),
which only dequeues the timer and does not wait for a callback that is
already executing; the preceding free_irq() calls synchronize the
interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can
therefore be running past the teardown and use the wcn freed along
with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock,
reads wcn->tx_ack_skb and passes wcn->hw to
ieee80211_tx_status_irqsafe().

Fix this by using timer_shutdown_sync(), which waits for a running
callback and also prevents the timer from being rearmed again. The
timer is set up again by wcn36xx_dxe_init() on the next start, so the
start/stop cycle is unaffected.

This issue was found by an in-house static analysis tool.

Fixes: fdf21cc37149 ("wcn36xx: Add TX ack support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Song Li 
Signed-off-by: Song Li 
Signed-off-by: Fan Wu 
Reviewed-by: Loic Poulain 
Link: https://patch.msgid.link/20260910020907.3353-1-fanwu01@zju.edu.cn
Signed-off-by: Jeff Johnson

wifi: ath12k: ahb: Revert undocumented ABI and dead code

2026-09-14T18:43:30+00:00

Commit 96f46607bbce ("wifi: ath12k: add AHB platform descriptor
support") added undocumented OF ABI, by relying on a very specific node
name.  This is not allowed and was never acked by Devicetree
maintainers.

Additionally that part of code is not even used, because all devices
have exactly the same user pd, so this was added "for future".  Adding
dead code just "for future" is heavily discouraged in kernel coding.

Signed-off-by: Krzysztof Kozlowski 
Link: https://patch.msgid.link/20260825081313.71351-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Jeff Johnson

wifi: libipw: reject TKIP frames without a full MIC

2026-09-14T12:48:20+00:00

libipw_michael_mic_verify() assumes that an skb contains an eight-byte
Michael MIC. A short TKIP frame makes the unsigned payload length wrap,
causing michael_mic() to read past the skb.

Check that the MIC is present before verifying it, and use the existing
MICHAEL_MIC_LEN constant for all MIC lengths in the verifier.

Fixes: b453872c35cf ("[NET] ieee80211 subsystem")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://patch.msgid.link/20260909061124.3802517-1-4ncienth@gmail.com
Signed-off-by: Johannes Berg

wifi: virt_wifi: don't transfer operstate before register

2026-09-14T12:48:01+00:00

virt_wifi_newlink() calls netif_stacked_transfer_operstate() before
register_netdevice(). If the lower device is dormant, that queues the
new netdev on lweventlist while it is still uninitialized. If
registration fails after that, for example because of an invalid name
such as "bad/name", free_netdev() immediately frees the object. A
later linkwatch_fire_event() then use-after-frees the list entry.

Move the transfer to after netdev_upper_dev_link(), as macvlan and
ipvlan already do.

Fixes: c7cdba31ed8b ("mac80211-next: rtnetlink wifi simulation device")
Reported-by: Vega 
Assisted-by: LLM
Co-developed-by: Luxing Yin 
Signed-off-by: Luxing Yin 
Signed-off-by: Zihan Xi 
Link: https://patch.msgid.link/f5a832fb0ab228ce6e2b5a91fba4ca8b79198a2f.1788948455.git.zihanx@nebusec.ai
Signed-off-by: Johannes Berg