Commit a83155cc authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'wireless-2025-10-23' of... 

Merge tag 'wireless-2025-10-23' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
First set of fixes:
 - brcmfmac: long-standing crash when used w/o P2P
 - iwlwifi: fix for a use-after-free bug
 - mac80211: key tailroom accounting bug could leave
             allocation overhead and cause a warning
 - ath11k: add a missing platform,
           fix key flag operations
 - bcma: skip devices disabled in OF/DT
 - various (potential) memory leaks

* tag 'wireless-2025-10-23' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: nl80211: call kfree without a NULL check
  wifi: mac80211: fix key tailroom accounting leak
  wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
  MAINTAINERS: wcn36xx: Add linux-wireless list
  bcma: don't register devices disabled in OF
  wifi: mac80211: reset FILS discovery and unsol probe resp intervals
  wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()
  wifi: ath11k: avoid bit operation on key flags
  wifi: ath12k: free skb during idr cleanup callback
  wifi: ath11k: Add missing platform IDs for quirk table
  wifi: ath10k: Fix memory leak on unsupported WMI command
====================

Link: https://patch.msgid.link/20251023180604.626946-3-johannes@sipsolutions.net


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents ab431bc3 69e4b75a

MAINTAINERS

+1 −0
Original line number Diff line number Diff line
@@ -21318,6 +21318,7 @@ F: drivers/media/platform/qcom/venus/ 
QUALCOMM WCN36XX WIRELESS DRIVER

M:	Loic Poulain <loic.poulain@oss.qualcomm.com>

L:	wcn36xx@lists.infradead.org

L:	linux-wireless@vger.kernel.org

S:	Supported

W:	https://wireless.wiki.kernel.org/en/users/Drivers/wcn36xx

F:	drivers/net/wireless/ath/wcn36xx/

drivers/bcma/main.c

+6 −0
Original line number Diff line number Diff line
@@ -294,6 +294,8 @@ static int bcma_register_devices(struct bcma_bus *bus) 
	int err;



	list_for_each_entry(core, &bus->cores, list) {

		struct device_node *np;



		/* We support that core ourselves */

		switch (core->id.id) {

		case BCMA_CORE_4706_CHIPCOMMON:
@@ -311,6 +313,10 @@ static int bcma_register_devices(struct bcma_bus *bus) 
		if (bcma_is_core_needed_early(core->id.id))

			continue;



		np = core->dev.of_node;

		if (np && !of_device_is_available(np))

			continue;



		/* Only first GMAC core on BCM4706 is connected and working */

		if (core->id.id == BCMA_CORE_4706_MAC_GBIT &&

		    core->core_unit > 0)

drivers/net/wireless/ath/ath10k/wmi.c

+1 −0
Original line number Diff line number Diff line
@@ -1937,6 +1937,7 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id) 
	if (cmd_id == WMI_CMD_UNSUPPORTED) {

		ath10k_warn(ar, "wmi command %d is not supported by firmware\n",

			    cmd_id);

		dev_kfree_skb_any(skb);

		return ret;

	}

drivers/net/wireless/ath/ath11k/core.c

+48 −6
Original line number Diff line number Diff line
@@ -912,42 +912,84 @@ static const struct ath11k_hw_params ath11k_hw_params[] = { 
static const struct dmi_system_id ath11k_pm_quirk_table[] = {

	{

		.driver_data = (void *)ATH11K_PM_WOW,

		.matches = {

		.matches = { /* X13 G4 AMD #1 */

			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),

			DMI_MATCH(DMI_PRODUCT_NAME, "21J3"),

		},

	},

	{

		.driver_data = (void *)ATH11K_PM_WOW,

		.matches = { /* X13 G4 AMD #2 */

			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),

			DMI_MATCH(DMI_PRODUCT_NAME, "21J4"),

		},

	},

	{

		.driver_data = (void *)ATH11K_PM_WOW,

		.matches = {

		.matches = { /* T14 G4 AMD #1 */

			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),

			DMI_MATCH(DMI_PRODUCT_NAME, "21K3"),

		},

	},

	{

		.driver_data = (void *)ATH11K_PM_WOW,

		.matches = { /* T14 G4 AMD #2 */

			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),

			DMI_MATCH(DMI_PRODUCT_NAME, "21K4"),

		},

	},

	{

		.driver_data = (void *)ATH11K_PM_WOW,

		.matches = {

		.matches = { /* P14s G4 AMD #1 */

			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),

			DMI_MATCH(DMI_PRODUCT_NAME, "21K5"),

		},

	},

	{

		.driver_data = (void *)ATH11K_PM_WOW,

		.matches = { /* P14s G4 AMD #2 */

			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),

			DMI_MATCH(DMI_PRODUCT_NAME, "21K6"),

		},

	},

	{

		.driver_data = (void *)ATH11K_PM_WOW,

		.matches = {

		.matches = { /* T16 G2 AMD #1 */

			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),

			DMI_MATCH(DMI_PRODUCT_NAME, "21K7"),

		},

	},

	{

		.driver_data = (void *)ATH11K_PM_WOW,

		.matches = { /* T16 G2 AMD #2 */

			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),

			DMI_MATCH(DMI_PRODUCT_NAME, "21K8"),

		},

	},

	{

		.driver_data = (void *)ATH11K_PM_WOW,

		.matches = {

		.matches = { /* P16s G2 AMD #1 */

			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),

			DMI_MATCH(DMI_PRODUCT_NAME, "21K9"),

		},

	},

	{

		.driver_data = (void *)ATH11K_PM_WOW,

		.matches = { /* P16s G2 AMD #2 */

			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),

			DMI_MATCH(DMI_PRODUCT_NAME, "21KA"),

		},

	},

	{

		.driver_data = (void *)ATH11K_PM_WOW,

		.matches = {

		.matches = { /* T14s G4 AMD #1 */

			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),

			DMI_MATCH(DMI_PRODUCT_NAME, "21F8"),

		},

	},

	{

		.driver_data = (void *)ATH11K_PM_WOW,

		.matches = { /* T14s G4 AMD #2 */

			DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),

			DMI_MATCH(DMI_PRODUCT_NAME, "21F9"),

		},

drivers/net/wireless/ath/ath11k/mac.c

+5 −5
Original line number Diff line number Diff line 
// SPDX-License-Identifier: BSD-3-Clause-Clear

/*

 * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.

 * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.

 */



#include <net/mac80211.h>
@@ -4417,9 +4417,9 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, 
	}



	if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)

		flags |= WMI_KEY_PAIRWISE;

		flags = WMI_KEY_PAIRWISE;

	else

		flags |= WMI_KEY_GROUP;

		flags = WMI_KEY_GROUP;



	ath11k_dbg(ar->ab, ATH11K_DBG_MAC,

		   "%s for peer %pM on vdev %d flags 0x%X, type = %d, num_sta %d\n",
@@ -4456,7 +4456,7 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, 


	is_ap_with_no_sta = (vif->type == NL80211_IFTYPE_AP &&

			     !arvif->num_stations);

	if ((flags & WMI_KEY_PAIRWISE) || cmd == SET_KEY || is_ap_with_no_sta) {

	if (flags == WMI_KEY_PAIRWISE || cmd == SET_KEY || is_ap_with_no_sta) {

		ret = ath11k_install_key(arvif, key, cmd, peer_addr, flags);

		if (ret) {

			ath11k_warn(ab, "ath11k_install_key failed (%d)\n", ret);
@@ -4470,7 +4470,7 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, 
			goto exit;

		}



		if ((flags & WMI_KEY_GROUP) && cmd == SET_KEY && is_ap_with_no_sta)

		if (flags == WMI_KEY_GROUP && cmd == SET_KEY && is_ap_with_no_sta)

			arvif->reinstall_group_keys = true;

	}