Commit 6668c6f2 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'wireless-2026-02-25' of... 

Merge tag 'wireless-2026-02-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
A good number of fixes:
 - cfg80211:
   - cancel rfkill work appropriately
   - fix radiotap parsing to correctly reject field 18
   - fix wext (yes...) off-by-one for IGTK key ID
 - mac80211:
   - fix for mesh NULL pointer dereference
   - fix for stack out-of-bounds (2 bytes) write on
     specific multi-link action frames
   - set default WMM parameters for all links
 - mwifiex: check dev_alloc_name() return value correctly
 - libertas: fix potential timer use-after-free
 - brcmfmac: fix crash on probe failure

* tag 'wireless-2026-02-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
  wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
  wifi: mac80211: set default WMM parameters on all links
  wifi: libertas: fix use-after-free in lbs_free_adapter()
  wifi: mwifiex: Fix dev_alloc_name() return value check
  wifi: brcmfmac: Fix potential kernel oops when probe fails
  wifi: radiotap: reject radiotap with unknown bits
  wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
  wifi: cfg80211: wext: fix IGTK key ID off-by-one
====================

Link: https://patch.msgid.link/20260225113159.360574-3-johannes@sipsolutions.net


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 77da7128 017c1792

drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c

+3 −4
Original line number Diff line number Diff line
@@ -951,11 +951,10 @@ int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev) 
		goto out;



	/* try to attach to the target device */

	sdiodev->bus = brcmf_sdio_probe(sdiodev);

	if (IS_ERR(sdiodev->bus)) {

		ret = PTR_ERR(sdiodev->bus);

	ret = brcmf_sdio_probe(sdiodev);

	if (ret)

		goto out;

	}



	brcmf_sdiod_host_fixup(sdiodev->func2->card->host);

out:

	if (ret)

drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c

+4 −3
Original line number Diff line number Diff line
@@ -4445,7 +4445,7 @@ brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus) 
	return fwreq;

}



struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)

int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)

{

	int ret;

	struct brcmf_sdio *bus;
@@ -4551,11 +4551,12 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev) 
		goto fail;

	}



	return bus;

	return 0;



fail:

	brcmf_sdio_remove(bus);

	return ERR_PTR(ret);

	sdiodev->bus = NULL;

	return ret;

}



/* Detach and free everything */

drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h

+1 −1
Original line number Diff line number Diff line
@@ -358,7 +358,7 @@ void brcmf_sdiod_freezer_uncount(struct brcmf_sdio_dev *sdiodev); 
int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev);

int brcmf_sdiod_remove(struct brcmf_sdio_dev *sdiodev);



struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);

int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);

void brcmf_sdio_remove(struct brcmf_sdio *bus);

void brcmf_sdio_isr(struct brcmf_sdio *bus, bool in_isr);

drivers/net/wireless/marvell/libertas/main.c

+2 −2
Original line number Diff line number Diff line
@@ -799,8 +799,8 @@ static void lbs_free_adapter(struct lbs_private *priv) 
{

	lbs_free_cmd_buffer(priv);

	kfifo_free(&priv->event_fifo);

	timer_delete(&priv->command_timer);

	timer_delete(&priv->tx_lockup_timer);

	timer_delete_sync(&priv->command_timer);

	timer_delete_sync(&priv->tx_lockup_timer);

}



static const struct net_device_ops lbs_netdev_ops = {

drivers/net/wireless/marvell/mwifiex/cfg80211.c

+1 −1
Original line number Diff line number Diff line
@@ -3148,7 +3148,7 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy, 
	SET_NETDEV_DEV(dev, adapter->dev);



	ret = dev_alloc_name(dev, name);

	if (ret)

	if (ret < 0)

		goto err_alloc_name;



	priv->dfs_cac_workqueue = alloc_workqueue("MWIFIEX_DFS_CAC-%s",