[GIT PULL] wireless-2025-07-10

[GIT PULL] wireless-2025-07-10

[Johannes Berg]

Hi,

So I have more fixes than I'd like at this point, but a few
were under discussion for a while, mt76 fixes were just not
forthcoming until now, and all of them really don't seem
wrong to put into the tree at this point...

Please pull and let us know if there's any problem.

Thanks,
johannes



The following changes since commit e34a79b96ab9d49ed8b605fee11099cf3efbb428:

  Merge tag 'net-6.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2025-06-26 09:13:27 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git tags/wireless-2025-07-10

for you to fetch changes up to c07981af55d3ba3ec3be880cfe4a0cc10f1f7138:

  wifi: mac80211: add the virtual monitor after reconfig complete (2025-07-10 13:27:14 +0200)

----------------------------------------------------------------
Quite a number of fixes still:
 - mt76 (hadn't sent any fixes so far)
   - RCU
   - scanning
   - decapsulation offload
   - interface combinations
 - rt2x00: build fix (bad function pointer prototype)
 - cfg80211: prevent A-MSDU flipping attacks in mesh
 - zd1211rw: prevent race ending with NULL ptr deref
 - cfg80211/mac80211: more S1G fixes
 - mwifiex: avoid WARN on certain RX frames
 - mac80211:
   - avoid stack data leak in WARN cases
   - fix non-transmitted BSSID search
     (on certain multi-BSSID APs)
   - always initialize key list so driver
     iteration won't crash
   - fix monitor interface in device restart
   - fix __free() annotation usage

----------------------------------------------------------------
Daniil Dulov (1):
      wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()

Deren Wu (2):
      wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload()
      wifi: mt76: mt7921: prevent decap offload config before STA initialization

Felix Fietkau (3):
      wifi: rt2x00: fix remove callback type mismatch
      wifi: mt76: add a wrapper for wcid access with validation
      wifi: mt76: fix queue assignment for deauth packets

Henry Martin (1):
      wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init()

Johannes Berg (3):
      wifi: mac80211: clear frame buffer to never leak stack
      wifi: mac80211: fix non-transmitted BSSID profile search
      Merge tag 'mt76-fixes-2025-07-07' of https://github.com/nbd168/wireless

Lachlan Hodges (2):
      wifi: cfg80211: fix S1G beacon head validation in nl80211
      wifi: mac80211: correctly identify S1G short beacon

Leon Yen (1):
      wifi: mt76: mt792x: Limit the concurrent STA and SoftAP to operate on the same channel

Lorenzo Bianconi (5):
      wifi: mt76: Assume __mt76_connac_mcu_alloc_sta_req runs in atomic context
      wifi: mt76: Move RCU section in mt7996_mcu_set_fixed_field()
      wifi: mt76: Move RCU section in mt7996_mcu_add_rate_ctrl_fixed()
      wifi: mt76: Move RCU section in mt7996_mcu_add_rate_ctrl()
      wifi: mt76: Remove RCU section in mt7996_mac_sta_rc_work()

Mathy Vanhoef (1):
      wifi: prevent A-MSDU attacks in mesh networks

Michael Lo (1):
      wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan

Ming Yen Hsieh (2):
      wifi: mt76: mt7925: fix the wrong config for tx interrupt
      wifi: mt76: mt7925: fix incorrect scan probe IE handling for hw_scan

Miri Korenblit (2):
      wifi: mac80211: always initialize sdata::key_list
      wifi: mac80211: add the virtual monitor after reconfig complete

Moon Hee Lee (1):
      wifi: mac80211: reject VHT opmode for unsupported channel widths

Pagadala Yesu Anjaneyulu (1):
      wifi: mac80211: Fix uninitialized variable with __free() in ieee80211_ml_epcs()

Vitor Soares (1):
      wifi: mwifiex: discard erroneous disassoc frames on STA interface

 drivers/net/wireless/marvell/mwifiex/util.c        |   4 +-
 drivers/net/wireless/mediatek/mt76/mt76.h          |  10 ++
 drivers/net/wireless/mediatek/mt76/mt7603/dma.c    |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7603/mac.c    |  10 +-
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c    |   7 +-
 .../net/wireless/mediatek/mt76/mt76_connac_mac.c   |   2 +-
 .../net/wireless/mediatek/mt76/mt76_connac_mcu.c   |   6 +-
 drivers/net/wireless/mediatek/mt76/mt76x02.h       |   5 +-
 drivers/net/wireless/mediatek/mt76/mt76x02_mac.c   |   4 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mac.c    |  12 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7915/mmio.c   |   5 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mac.c    |   6 +-
 drivers/net/wireless/mediatek/mt76/mt7921/main.c   |   3 +
 drivers/net/wireless/mediatek/mt76/mt7925/init.c   |   2 +
 drivers/net/wireless/mediatek/mt76/mt7925/mac.c    |   6 +-
 drivers/net/wireless/mediatek/mt76/mt7925/main.c   |   8 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c    |  79 ++++++--
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.h    |   5 +-
 drivers/net/wireless/mediatek/mt76/mt7925/regs.h   |   2 +-
 drivers/net/wireless/mediatek/mt76/mt792x_core.c   |  32 +++-
 drivers/net/wireless/mediatek/mt76/mt792x_mac.c    |   5 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mac.c    |  52 ++----
 drivers/net/wireless/mediatek/mt76/mt7996/main.c   |   5 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c    | 199 +++++++++++++++------
 drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h |  16 +-
 drivers/net/wireless/mediatek/mt76/tx.c            |  11 +-
 drivers/net/wireless/mediatek/mt76/util.c          |   2 +-
 drivers/net/wireless/ralink/rt2x00/rt2x00soc.c     |   4 +-
 drivers/net/wireless/ralink/rt2x00/rt2x00soc.h     |   2 +-
 drivers/net/wireless/zydas/zd1211rw/zd_mac.c       |   6 +-
 include/linux/ieee80211.h                          |  45 +++--
 net/mac80211/cfg.c                                 |  14 ++
 net/mac80211/iface.c                               |   4 +-
 net/mac80211/mlme.c                                |  12 +-
 net/mac80211/parse.c                               |   6 +-
 net/mac80211/util.c                                |   9 +-
 net/wireless/nl80211.c                             |   7 +-
 net/wireless/util.c                                |  52 +++++-
 39 files changed, 430 insertions(+), 233 deletions(-)

Re: [GIT PULL] wireless-2025-07-10

[Jakub Kicinski]

On Thu, 10 Jul 2025 14:21:06 +0200 Johannes Berg wrote:
> So I have more fixes than I'd like at this point, but a few
> were under discussion for a while, mt76 fixes were just not
> forthcoming until now, and all of them really don't seem
> wrong to put into the tree at this point...
> 
> Please pull and let us know if there's any problem.

Some good news and some bad news. Bad news is that this missed today's
PR. Good news is that we shipped a bug to Linus which is likely to
break nl80211 users:
https://lore.kernel.org/all/20250711001121.3649033-1-kuba@kernel.org/
so I'm gonna send a second PR tomorrow, with the netlink fix and I'll
include your fixes in it. I suppose you may want to wait with the fast
forward until then. 
Now that I typed this I guess it may be two pieces of bad news..

Re: [GIT PULL] wireless-2025-07-10

[patchwork-bot+netdevbpf]

Hello:

This pull request was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 10 Jul 2025 14:21:06 +0200 you wrote:
> Hi,
> 
> So I have more fixes than I'd like at this point, but a few
> were under discussion for a while, mt76 fixes were just not
> forthcoming until now, and all of them really don't seem
> wrong to put into the tree at this point...
> 
> [...]

Here is the summary with links:
  - [GIT,PULL] wireless-2025-07-10
    https://git.kernel.org/netdev/net/c/7ac5cc261625

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [GIT PULL] wireless-2025-07-10

[Johannes Berg]

On Thu, 2025-07-10 at 17:23 -0700, Jakub Kicinski wrote:
> On Thu, 10 Jul 2025 14:21:06 +0200 Johannes Berg wrote:
> > So I have more fixes than I'd like at this point, but a few
> > were under discussion for a while, mt76 fixes were just not
> > forthcoming until now, and all of them really don't seem
> > wrong to put into the tree at this point...
> > 
> > Please pull and let us know if there's any problem.
> 
> Some good news and some bad news. Bad news is that this missed today's
> PR. Good news is that we shipped a bug to Linus which is likely to
> break nl80211 users:
> https://lore.kernel.org/all/20250711001121.3649033-1-kuba@kernel.org/
> so I'm gonna send a second PR tomorrow, with the netlink fix and I'll
> include your fixes in it. I suppose you may want to wait with the fast
> forward until then. 
> Now that I typed this I guess it may be two pieces of bad news..

No worries, and thanks for the heads-up, I can wait. I actually really
hope this was the last pull request for the current -rc cycle anyway,
but of course now that I said it someone's going to come out of the
woodwork with a fix ;)

Re the size problem, nl80211 can indeed create and fill really big SKBs
if userspace gives a big buffer, which it often does. Looking at it now,
I'm not sure why we set the rcvbuf to 8KiB in iw? That seems ... odd. It
looks like I originally did that to _increase_ it, but that seems
completely off, and my first fix didn't even do anything. Then we fixed
the call but ...

Looks like the problem is entirely self-made there, but I guess we still
have to live with stupid userspace, sorry about that. I can take a
closer look at it all and try to fix things there, if you think it's
worth it?

johannes

Re: [GIT PULL] wireless-2025-07-10

[Jeff Johnson]

On 7/10/2025 11:41 PM, Johannes Berg wrote:
> No worries, and thanks for the heads-up, I can wait. I actually really
> hope this was the last pull request for the current -rc cycle anyway,
> but of course now that I said it someone's going to come out of the
> woodwork with a fix ;)

<sticks out head>
I have one small patch for -rc7.
I'm holding off a PR until Monday to make sure there aren't any more

/jeff

Re: [GIT PULL] wireless-2025-07-10

[Jakub Kicinski]

On Fri, 11 Jul 2025 08:41:28 +0200 Johannes Berg wrote:
> > Some good news and some bad news. Bad news is that this missed today's
> > PR. Good news is that we shipped a bug to Linus which is likely to
> > break nl80211 users:
> > https://lore.kernel.org/all/20250711001121.3649033-1-kuba@kernel.org/
> > so I'm gonna send a second PR tomorrow, with the netlink fix and I'll
> > include your fixes in it. I suppose you may want to wait with the fast
> > forward until then. 
> > Now that I typed this I guess it may be two pieces of bad news..  
> 
> No worries, and thanks for the heads-up, I can wait. I actually really
> hope this was the last pull request for the current -rc cycle anyway,
> but of course now that I said it someone's going to come out of the
> woodwork with a fix ;)
> 
> Re the size problem, nl80211 can indeed create and fill really big SKBs
> if userspace gives a big buffer, which it often does. Looking at it now,
> I'm not sure why we set the rcvbuf to 8KiB in iw? That seems ... odd. It
> looks like I originally did that to _increase_ it, but that seems
> completely off, and my first fix didn't even do anything. Then we fixed
> the call but ...
> 
> Looks like the problem is entirely self-made there, but I guess we still
> have to live with stupid userspace, sorry about that. I can take a
> closer look at it all and try to fix things there, if you think it's
> worth it?

Probably not, unless it's hurting in another way. The well maintained
userspace is usually not what we have to worry about the most with
netlink.

I was holding off replying until the dust has fully settled but it
sounds like Linus is still hitting some hard to pin down regression. 
I don't _think_ it's us any more, so I reckon you're safe to fast
forward.