Commit 2697c45a authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'wireless-2026-03-04' of... 

Merge tag 'wireless-2026-03-04' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Some more fixes:
 - mt76 gets three almost identical new length checks
 - cw1200 & ti: locking fixes
 - mac80211 has a fix for the recent EML frame handling
 - rsi driver no longer oddly responds to config, which
   had triggered a warning in mac80211
 - ath12k has two fixes for station statistics handling

* tag 'wireless-2026-03-04' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
  wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()
  wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()
  wifi: wlcore: Fix a locking bug
  wifi: cw1200: Fix locking in error paths
  wifi: mac80211: fix missing ieee80211_eml_params member initialization
  wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config
  wifi: ath12k: fix station lookup failure when disconnecting from AP
  wifi: ath12k: use correct pdev id when requesting firmware stats
====================

Link: https://patch.msgid.link/20260304112500.169639-3-johannes@sipsolutions.net


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 126fe7ef 4e10a730

drivers/net/wireless/ath/ath12k/mac.c

+3 −3
Original line number Diff line number Diff line
@@ -5430,7 +5430,7 @@ int ath12k_mac_op_get_txpower(struct ieee80211_hw *hw, 
					 ar->last_tx_power_update))

		goto send_tx_power;



	params.pdev_id = ar->pdev->pdev_id;

	params.pdev_id = ath12k_mac_get_target_pdev_id(ar);

	params.vdev_id = arvif->vdev_id;

	params.stats_id = WMI_REQUEST_PDEV_STAT;

	ret = ath12k_mac_get_fw_stats(ar, &params);
@@ -13452,7 +13452,7 @@ void ath12k_mac_op_sta_statistics(struct ieee80211_hw *hw, 
	/* TODO: Use real NF instead of default one. */

	signal = rate_info.rssi_comb;



	params.pdev_id = ar->pdev->pdev_id;

	params.pdev_id = ath12k_mac_get_target_pdev_id(ar);

	params.vdev_id = 0;

	params.stats_id = WMI_REQUEST_VDEV_STAT;
@@ -13580,7 +13580,7 @@ void ath12k_mac_op_link_sta_statistics(struct ieee80211_hw *hw, 
	spin_unlock_bh(&ar->ab->dp->dp_lock);



	if (!signal && ahsta->ahvif->vdev_type == WMI_VDEV_TYPE_STA) {

		params.pdev_id = ar->pdev->pdev_id;

		params.pdev_id = ath12k_mac_get_target_pdev_id(ar);

		params.vdev_id = 0;

		params.stats_id = WMI_REQUEST_VDEV_STAT;

drivers/net/wireless/ath/ath12k/wmi.c

+13 −23
Original line number Diff line number Diff line
@@ -8241,8 +8241,6 @@ static int ath12k_wmi_tlv_fw_stats_data_parse(struct ath12k_base *ab, 
	struct ath12k_fw_stats *stats = parse->stats;

	struct ath12k *ar;

	struct ath12k_link_vif *arvif;

	struct ieee80211_sta *sta;

	struct ath12k_sta *ahsta;

	struct ath12k_link_sta *arsta;

	int i, ret = 0;

	const void *data = ptr;
@@ -8278,21 +8276,19 @@ static int ath12k_wmi_tlv_fw_stats_data_parse(struct ath12k_base *ab, 


		arvif = ath12k_mac_get_arvif(ar, le32_to_cpu(src->vdev_id));

		if (arvif) {

			sta = ieee80211_find_sta_by_ifaddr(ath12k_ar_to_hw(ar),

							   arvif->bssid,

							   NULL);

			if (sta) {

				ahsta = ath12k_sta_to_ahsta(sta);

				arsta = &ahsta->deflink;

			spin_lock_bh(&ab->base_lock);

			arsta = ath12k_link_sta_find_by_addr(ab, arvif->bssid);

			if (arsta) {

				arsta->rssi_beacon = le32_to_cpu(src->beacon_snr);

				ath12k_dbg(ab, ATH12K_DBG_WMI,

					   "wmi stats vdev id %d snr %d\n",

					   src->vdev_id, src->beacon_snr);

			} else {

				ath12k_dbg(ab, ATH12K_DBG_WMI,

					   "not found station bssid %pM for vdev stat\n",

				ath12k_warn(ab,

					    "not found link sta with bssid %pM for vdev stat\n",

					    arvif->bssid);

			}

			spin_unlock_bh(&ab->base_lock);

		}



		data += sizeof(*src);
@@ -8363,8 +8359,6 @@ static int ath12k_wmi_tlv_rssi_chain_parse(struct ath12k_base *ab, 
	struct ath12k_fw_stats *stats = parse->stats;

	struct ath12k_link_vif *arvif;

	struct ath12k_link_sta *arsta;

	struct ieee80211_sta *sta;

	struct ath12k_sta *ahsta;

	struct ath12k *ar;

	int vdev_id;

	int j;
@@ -8400,19 +8394,15 @@ static int ath12k_wmi_tlv_rssi_chain_parse(struct ath12k_base *ab, 
		   "stats bssid %pM vif %p\n",

		   arvif->bssid, arvif->ahvif->vif);



	sta = ieee80211_find_sta_by_ifaddr(ath12k_ar_to_hw(ar),

					   arvif->bssid,

					   NULL);

	if (!sta) {

		ath12k_dbg(ab, ATH12K_DBG_WMI,

			   "not found station of bssid %pM for rssi chain\n",

	guard(spinlock_bh)(&ab->base_lock);

	arsta = ath12k_link_sta_find_by_addr(ab, arvif->bssid);

	if (!arsta) {

		ath12k_warn(ab,

			    "not found link sta with bssid %pM for rssi chain\n",

			    arvif->bssid);

		return -EPROTO;

	}



	ahsta = ath12k_sta_to_ahsta(sta);

	arsta = &ahsta->deflink;



	BUILD_BUG_ON(ARRAY_SIZE(arsta->chain_signal) >

		     ARRAY_SIZE(stats_rssi->rssi_avg_beacon));

drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c

+1 −0
Original line number Diff line number Diff line
@@ -413,6 +413,7 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi, 
	u32 val;



	if (ieee80211_is_action(fc) &&

	    skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 + 1 + 2 &&

	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&

	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {

		u16 capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);

drivers/net/wireless/mediatek/mt76/mt7925/mac.c

+1 −0
Original line number Diff line number Diff line
@@ -668,6 +668,7 @@ mt7925_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi, 
	u32 val;



	if (ieee80211_is_action(fc) &&

	    skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 &&

	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&

	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ)

		tid = MT_TX_ADDBA;

drivers/net/wireless/mediatek/mt76/mt7996/mac.c

+1 −0
Original line number Diff line number Diff line
@@ -800,6 +800,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi, 
	u32 val;



	if (ieee80211_is_action(fc) &&

	    skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 &&

	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&

	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {

		if (is_mt7990(&dev->mt76))