Commit 7c46bd84 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'wireless-2026-03-18' of... 

Merge tag 'wireless-2026-03-18' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Just a few updates:
 - cfg80211:
   - guarantee pmsr work is cancelled
 - mac80211:
   - reject TDLS operations on non-TDLS stations
   - fix crash in AP_VLAN bandwidth change
   - fix leak or double-free on some TX preparation
     failures
   - remove keys needed for beacons _after_ stopping
     those
   - fix debugfs static branch race
   - avoid underflow in inactive time
   - fix another NULL dereference in mesh on invalid
     frames
 - ti/wlcore: avoid infinite realloc loop

* tag 'wireless-2026-03-18' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
  wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
  wifi: mac80211: fix NULL deref in mesh_matches_local()
  wifi: mac80211: check tdls flag in ieee80211_tdls_oper
  wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
  wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
  mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
  wifi: mac80211: use jiffies_delta_to_msecs() for sta_info inactive times
  wifi: mac80211: remove keys after disabling beaconing
  wifi: mac80211_hwsim: fully initialise PMSR capabilities
====================

Link: https://patch.msgid.link/20260318172515.381148-3-johannes@sipsolutions.net


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 605b5249 d5ad6ab6

drivers/net/wireless/ath/ath9k/channel.c

+2 −4
Original line number Diff line number Diff line
@@ -1006,7 +1006,7 @@ static void ath_scan_send_probe(struct ath_softc *sc, 
	skb_set_queue_mapping(skb, IEEE80211_AC_VO);



	if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, NULL))

		goto error;

		return;



	txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];

	if (ath_tx_start(sc->hw, skb, &txctl))
@@ -1119,10 +1119,8 @@ ath_chanctx_send_vif_ps_frame(struct ath_softc *sc, struct ath_vif *avp, 


		skb->priority = 7;

		skb_set_queue_mapping(skb, IEEE80211_AC_VO);

		if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta)) {

			dev_kfree_skb_any(skb);

		if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta))

			return false;

		}

		break;

	default:

		return false;

drivers/net/wireless/mediatek/mt76/scan.c

+1 −3
Original line number Diff line number Diff line
@@ -63,10 +63,8 @@ mt76_scan_send_probe(struct mt76_dev *dev, struct cfg80211_ssid *ssid) 


	rcu_read_lock();



	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) {

		ieee80211_free_txskb(phy->hw, skb);

	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL))

		goto out;

	}



	info = IEEE80211_SKB_CB(skb);

	if (req->no_cck)

drivers/net/wireless/ti/wlcore/tx.c

+1 −1
Original line number Diff line number Diff line
@@ -210,7 +210,7 @@ static int wl1271_tx_allocate(struct wl1271 *wl, struct wl12xx_vif *wlvif, 
		if (skb_headroom(skb) < (total_len - skb->len) &&

		    pskb_expand_head(skb, (total_len - skb->len), 0, GFP_ATOMIC)) {

			wl1271_free_tx_id(wl, id);

			return -EAGAIN;

			return -ENOMEM;

		}

		desc = skb_push(skb, total_len - skb->len);

drivers/net/wireless/virtual/mac80211_hwsim.c

+1 −2
Original line number Diff line number Diff line
@@ -3021,7 +3021,6 @@ static void hw_scan_work(struct work_struct *work) 
						      hwsim->tmp_chan->band,

						      NULL)) {

				rcu_read_unlock();

				kfree_skb(probe);

				continue;

			}
@@ -6489,7 +6488,7 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) 
	if (info->attrs[HWSIM_ATTR_PMSR_SUPPORT]) {

		struct cfg80211_pmsr_capabilities *pmsr_capa;



		pmsr_capa = kmalloc_obj(*pmsr_capa);

		pmsr_capa = kzalloc_obj(*pmsr_capa);

		if (!pmsr_capa) {

			ret = -ENOMEM;

			goto out_free;

include/net/mac80211.h

+3 −1
Original line number Diff line number Diff line
@@ -7407,7 +7407,9 @@ void ieee80211_report_wowlan_wakeup(struct ieee80211_vif *vif, 
 * @band: the band to transmit on

 * @sta: optional pointer to get the station to send the frame to

 *

 * Return: %true if the skb was prepared, %false otherwise

 * Return: %true if the skb was prepared, %false otherwise.

 * On failure, the skb is freed by this function; callers must not

 * free it again.

 *

 * Note: must be called under RCU lock

 */