Commit 9540984d authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'wireless-2025-05-06' of... 

Merge tag 'wireless-2025-05-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Couple of fixes:
 * iwlwifi: add two missing device entries
 * cfg80211: fix a potential out-of-bounds access
 * mac80211: fix format of TID to link mapping action frames

* tag 'wireless-2025-05-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: iwlwifi: add support for Killer on MTL
  wifi: mac80211: fix the type of status_code for negotiated TID to Link Mapping
  wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
====================

Link: https://patch.msgid.link/20250506203506.158818-3-johannes@sipsolutions.net


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 2e6259d8 ebedf8b7

drivers/net/wireless/intel/iwlwifi/pcie/drv.c

+2 −0
Original line number Diff line number Diff line
@@ -588,6 +588,8 @@ VISIBLE_IF_IWLWIFI_KUNIT const struct iwl_dev_info iwl_dev_info_table[] = { 
	IWL_DEV_INFO(0x7A70, 0x1692, iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690i_name),

	IWL_DEV_INFO(0x7AF0, 0x1691, iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690s_name),

	IWL_DEV_INFO(0x7AF0, 0x1692, iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690i_name),

	IWL_DEV_INFO(0x7F70, 0x1691, iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690s_name),

	IWL_DEV_INFO(0x7F70, 0x1692, iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690i_name),



	IWL_DEV_INFO(0x271C, 0x0214, iwl9260_2ac_cfg, iwl9260_1_name),

	IWL_DEV_INFO(0x7E40, 0x1691, iwl_cfg_ma, iwl_ax411_killer_1690s_name),

include/linux/ieee80211.h

+1 −1
Original line number Diff line number Diff line
@@ -1526,7 +1526,7 @@ struct ieee80211_mgmt { 
				struct {

					u8 action_code;

					u8 dialog_token;

					u8 status_code;

					__le16 status_code;

					u8 variable[];

				} __packed ttlm_res;

				struct {

net/mac80211/mlme.c

+6 −6
Original line number Diff line number Diff line
@@ -7675,6 +7675,7 @@ ieee80211_send_neg_ttlm_res(struct ieee80211_sub_if_data *sdata, 
	int hdr_len = offsetofend(struct ieee80211_mgmt, u.action.u.ttlm_res);

	int ttlm_max_len = 2 + 1 + sizeof(struct ieee80211_ttlm_elem) + 1 +

		2 * 2 * IEEE80211_TTLM_NUM_TIDS;

	u16 status_code;



	skb = dev_alloc_skb(local->tx_headroom + hdr_len + ttlm_max_len);

	if (!skb)
@@ -7697,19 +7698,18 @@ ieee80211_send_neg_ttlm_res(struct ieee80211_sub_if_data *sdata, 
		WARN_ON(1);

		fallthrough;

	case NEG_TTLM_RES_REJECT:

		mgmt->u.action.u.ttlm_res.status_code =

			WLAN_STATUS_DENIED_TID_TO_LINK_MAPPING;

		status_code = WLAN_STATUS_DENIED_TID_TO_LINK_MAPPING;

		break;

	case NEG_TTLM_RES_ACCEPT:

		mgmt->u.action.u.ttlm_res.status_code = WLAN_STATUS_SUCCESS;

		status_code = WLAN_STATUS_SUCCESS;

		break;

	case NEG_TTLM_RES_SUGGEST_PREFERRED:

		mgmt->u.action.u.ttlm_res.status_code =

			WLAN_STATUS_PREF_TID_TO_LINK_MAPPING_SUGGESTED;

		status_code = WLAN_STATUS_PREF_TID_TO_LINK_MAPPING_SUGGESTED;

		ieee80211_neg_ttlm_add_suggested_map(skb, neg_ttlm);

		break;

	}



	mgmt->u.action.u.ttlm_res.status_code = cpu_to_le16(status_code);

	ieee80211_tx_skb(sdata, skb);

}
@@ -7875,7 +7875,7 @@ void ieee80211_process_neg_ttlm_res(struct ieee80211_sub_if_data *sdata, 
	 * This can be better implemented in the future, to handle request

	 * rejections.

	 */

	if (mgmt->u.action.u.ttlm_res.status_code != WLAN_STATUS_SUCCESS)

	if (le16_to_cpu(mgmt->u.action.u.ttlm_res.status_code) != WLAN_STATUS_SUCCESS)

		__ieee80211_disconnect(sdata);

}

net/wireless/scan.c

+1 −1
Original line number Diff line number Diff line
@@ -2681,7 +2681,7 @@ cfg80211_defrag_mle(const struct element *mle, const u8 *ie, size_t ielen, 
	/* Required length for first defragmentation */

	buf_len = mle->datalen - 1;

	for_each_element(elem, mle->data + mle->datalen,

			 ielen - sizeof(*mle) + mle->datalen) {

			 ie + ielen - mle->data - mle->datalen) {

		if (elem->id != WLAN_EID_FRAGMENT)

			break;