* Re: [PATCH v1] wifi: ath9k: Fix typo
From: Jeff Johnson @ 2026-02-24 21:34 UTC (permalink / raw)
To: Alejandro Colomar
Cc: Toke Høiland-Jørgensen, linux-wireless,
Rajkumar Manoharan, John W. Linville, Greg KH
In-Reply-To: <aZ4Wq6h-nMt-G3pC@devuan>
On 2/24/2026 1:27 PM, Alejandro Colomar wrote:
> Hi Jeff,
>
> On 2026-02-24T10:45:02-0800, Jeff Johnson wrote:
>> On 2/23/2026 7:17 AM, Toke Høiland-Jørgensen wrote:
>>> Alejandro Colomar <alx@kernel.org> writes:
>>>
>>>> This only worked by chance, because all callers of this macro used the
>>>> same identifiers that were expected by the macro.
>>>>
>>>> $ grep -rn ath_for_each_chanctx
>>>> drivers/net/wireless/ath/ath9k/main.c:1576: ath_for_each_chanctx(sc, ctx)
>>>> drivers/net/wireless/ath/ath9k/main.c:2554: ath_for_each_chanctx(sc, ctx) {
>>>> drivers/net/wireless/ath/ath9k/channel.c:165: ath_for_each_chanctx(sc, ctx) {
>>>> drivers/net/wireless/ath/ath9k/channel.c:291: ath_for_each_chanctx(sc, ctx) {
>>>> drivers/net/wireless/ath/ath9k/channel.c:861: ath_for_each_chanctx(sc, ctx) {
>>>> drivers/net/wireless/ath/ath9k/debug.c:717: ath_for_each_chanctx(sc, ctx) {
>>>> drivers/net/wireless/ath/ath9k/ath9k.h:446:#define ath_for_each_chanctx(_sc, _ctx) \
>>>>
>>>> Fixes: c4dc0d040e35 (2014-06-19; "ath9k: Fetch appropriate operating channel context")
>>
>> I'm dropping the Fixes tag since the existing code actually works and hence
>> there is no need to backport to LTS kernels.
>
> Sounds reasonable. Alternatively, a line next to it saying
>
> [Do not backport]
>
> would work, I guess.
>
> Greg, I've seen this situation already a few times. A Fixes tag getting
> removed to avoid triggering a stable backport. But I think keeping the
> Fixes tag could be useful. Should we have a standard way to document
> that a patch fixes an old commit without meaning that it should be
> backported? Maybe something like this?:
>
> [Do not backport to stable]
> Fixes: ...
>
> In any case, feel free to remove it.
Looks like we have this:
There furthermore is a variant of the stable tag you can use to make the
stable team’s backporting tools (e.g AUTOSEL or scripts that look for commits
containing a ‘Fixes:’ tag) ignore a change:
Cc: <stable+noautosel@kernel.org> # reason goes here, and must be present
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html#option-1
Do you want to re-spin with that?
/jeff
^ permalink raw reply
* Re: [PATCH v1] wifi: ath9k: Fix typo
From: Greg KH @ 2026-02-24 21:37 UTC (permalink / raw)
To: Alejandro Colomar
Cc: Jeff Johnson, Toke Høiland-Jørgensen, linux-wireless,
Rajkumar Manoharan, John W. Linville
In-Reply-To: <aZ4Wq6h-nMt-G3pC@devuan>
On Tue, Feb 24, 2026 at 10:27:56PM +0100, Alejandro Colomar wrote:
> Hi Jeff,
>
> On 2026-02-24T10:45:02-0800, Jeff Johnson wrote:
> > On 2/23/2026 7:17 AM, Toke Høiland-Jørgensen wrote:
> > > Alejandro Colomar <alx@kernel.org> writes:
> > >
> > >> This only worked by chance, because all callers of this macro used the
> > >> same identifiers that were expected by the macro.
> > >>
> > >> $ grep -rn ath_for_each_chanctx
> > >> drivers/net/wireless/ath/ath9k/main.c:1576: ath_for_each_chanctx(sc, ctx)
> > >> drivers/net/wireless/ath/ath9k/main.c:2554: ath_for_each_chanctx(sc, ctx) {
> > >> drivers/net/wireless/ath/ath9k/channel.c:165: ath_for_each_chanctx(sc, ctx) {
> > >> drivers/net/wireless/ath/ath9k/channel.c:291: ath_for_each_chanctx(sc, ctx) {
> > >> drivers/net/wireless/ath/ath9k/channel.c:861: ath_for_each_chanctx(sc, ctx) {
> > >> drivers/net/wireless/ath/ath9k/debug.c:717: ath_for_each_chanctx(sc, ctx) {
> > >> drivers/net/wireless/ath/ath9k/ath9k.h:446:#define ath_for_each_chanctx(_sc, _ctx) \
> > >>
> > >> Fixes: c4dc0d040e35 (2014-06-19; "ath9k: Fetch appropriate operating channel context")
> >
> > I'm dropping the Fixes tag since the existing code actually works and hence
> > there is no need to backport to LTS kernels.
>
> Sounds reasonable. Alternatively, a line next to it saying
>
> [Do not backport]
>
> would work, I guess.
>
> Greg, I've seen this situation already a few times. A Fixes tag getting
> removed to avoid triggering a stable backport. But I think keeping the
> Fixes tag could be useful. Should we have a standard way to document
> that a patch fixes an old commit without meaning that it should be
> backported? Maybe something like this?:
>
> [Do not backport to stable]
> Fixes: ...
As per the in-kernel documentation file
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
There furthermore is a variant of the stable tag you can use to make the stable
team's backporting tools (e.g AUTOSEL or scripts that look for commits
containing a 'Fixes:' tag) ignore a change::
Cc: <stable+noautosel@kernel.org> # reason goes here, and must be present
So I think it is documented already :)
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH v1] wifi: ath9k: Fix typo
From: Alejandro Colomar @ 2026-02-24 22:52 UTC (permalink / raw)
To: Greg KH
Cc: Jeff Johnson, Toke Høiland-Jørgensen, linux-wireless,
Rajkumar Manoharan, John W. Linville
In-Reply-To: <2026022405-mundane-caucus-6aa9@gregkh>
[-- Attachment #1: Type: text/plain, Size: 701 bytes --]
Hi Greg,
On 2026-02-24T13:37:09-0800, Greg KH wrote:
> > [Do not backport to stable]
> > Fixes: ...
>
> As per the in-kernel documentation file
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
>
> There furthermore is a variant of the stable tag you can use to make the stable
> team's backporting tools (e.g AUTOSEL or scripts that look for commits
> containing a 'Fixes:' tag) ignore a change::
>
> Cc: <stable+noautosel@kernel.org> # reason goes here, and must be present
>
> So I think it is documented already :)
Thanks! I'll use that. :)
Cheers,
Alex
>
> thanks,
>
> greg k-h
--
<https://www.alejandro-colomar.es>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* Re: [PATCH v1] wifi: ath9k: Fix typo
From: Alejandro Colomar @ 2026-02-24 22:55 UTC (permalink / raw)
To: Jeff Johnson
Cc: Toke Høiland-Jørgensen, linux-wireless,
Rajkumar Manoharan, John W. Linville, Greg KH
In-Reply-To: <5e01a680-ebbc-4855-b1f9-e0381b3a8fc8@oss.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 2744 bytes --]
Hi Jeff,
On 2026-02-24T13:34:57-0800, Jeff Johnson wrote:
> On 2/24/2026 1:27 PM, Alejandro Colomar wrote:
> > Hi Jeff,
> >
> > On 2026-02-24T10:45:02-0800, Jeff Johnson wrote:
> >> On 2/23/2026 7:17 AM, Toke Høiland-Jørgensen wrote:
> >>> Alejandro Colomar <alx@kernel.org> writes:
> >>>
> >>>> This only worked by chance, because all callers of this macro used the
> >>>> same identifiers that were expected by the macro.
> >>>>
> >>>> $ grep -rn ath_for_each_chanctx
> >>>> drivers/net/wireless/ath/ath9k/main.c:1576: ath_for_each_chanctx(sc, ctx)
> >>>> drivers/net/wireless/ath/ath9k/main.c:2554: ath_for_each_chanctx(sc, ctx) {
> >>>> drivers/net/wireless/ath/ath9k/channel.c:165: ath_for_each_chanctx(sc, ctx) {
> >>>> drivers/net/wireless/ath/ath9k/channel.c:291: ath_for_each_chanctx(sc, ctx) {
> >>>> drivers/net/wireless/ath/ath9k/channel.c:861: ath_for_each_chanctx(sc, ctx) {
> >>>> drivers/net/wireless/ath/ath9k/debug.c:717: ath_for_each_chanctx(sc, ctx) {
> >>>> drivers/net/wireless/ath/ath9k/ath9k.h:446:#define ath_for_each_chanctx(_sc, _ctx) \
> >>>>
> >>>> Fixes: c4dc0d040e35 (2014-06-19; "ath9k: Fetch appropriate operating channel context")
> >>
> >> I'm dropping the Fixes tag since the existing code actually works and hence
> >> there is no need to backport to LTS kernels.
> >
> > Sounds reasonable. Alternatively, a line next to it saying
> >
> > [Do not backport]
> >
> > would work, I guess.
> >
> > Greg, I've seen this situation already a few times. A Fixes tag getting
> > removed to avoid triggering a stable backport. But I think keeping the
> > Fixes tag could be useful. Should we have a standard way to document
> > that a patch fixes an old commit without meaning that it should be
> > backported? Maybe something like this?:
> >
> > [Do not backport to stable]
> > Fixes: ...
> >
> > In any case, feel free to remove it.
>
> Looks like we have this:
> There furthermore is a variant of the stable tag you can use to make the
> stable team’s backporting tools (e.g AUTOSEL or scripts that look for commits
> containing a ‘Fixes:’ tag) ignore a change:
> Cc: <stable+noautosel@kernel.org> # reason goes here, and must be present
>
> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html#option-1
>
> Do you want to re-spin with that?
Would you mind amending to include the following tag?:
Cc: <stable+noautosel@kernel.org> # the code worked by chance
I don't know where I keep the patch, so I'd have to apply it from the
email to resend. Could you amend it yourself?
Have a lovely night!
Alex
>
> /jeff
--
<https://www.alejandro-colomar.es>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* Re: [PATCH v1] wifi: ath9k: Fix typo
From: Jeff Johnson @ 2026-02-24 23:07 UTC (permalink / raw)
To: Alejandro Colomar
Cc: Toke Høiland-Jørgensen, linux-wireless,
Rajkumar Manoharan, John W. Linville, Greg KH
In-Reply-To: <aZ4r6OUVCiHE-hhZ@devuan>
On 2/24/2026 2:55 PM, Alejandro Colomar wrote:
> Hi Jeff,
>
> On 2026-02-24T13:34:57-0800, Jeff Johnson wrote:
>> On 2/24/2026 1:27 PM, Alejandro Colomar wrote:
>>> Hi Jeff,
>>>
>>> On 2026-02-24T10:45:02-0800, Jeff Johnson wrote:
>>>> On 2/23/2026 7:17 AM, Toke Høiland-Jørgensen wrote:
>>>>> Alejandro Colomar <alx@kernel.org> writes:
>>>>>
>>>>>> This only worked by chance, because all callers of this macro used the
>>>>>> same identifiers that were expected by the macro.
>>>>>>
>>>>>> $ grep -rn ath_for_each_chanctx
>>>>>> drivers/net/wireless/ath/ath9k/main.c:1576: ath_for_each_chanctx(sc, ctx)
>>>>>> drivers/net/wireless/ath/ath9k/main.c:2554: ath_for_each_chanctx(sc, ctx) {
>>>>>> drivers/net/wireless/ath/ath9k/channel.c:165: ath_for_each_chanctx(sc, ctx) {
>>>>>> drivers/net/wireless/ath/ath9k/channel.c:291: ath_for_each_chanctx(sc, ctx) {
>>>>>> drivers/net/wireless/ath/ath9k/channel.c:861: ath_for_each_chanctx(sc, ctx) {
>>>>>> drivers/net/wireless/ath/ath9k/debug.c:717: ath_for_each_chanctx(sc, ctx) {
>>>>>> drivers/net/wireless/ath/ath9k/ath9k.h:446:#define ath_for_each_chanctx(_sc, _ctx) \
>>>>>>
>>>>>> Fixes: c4dc0d040e35 (2014-06-19; "ath9k: Fetch appropriate operating channel context")
>>>>
>>>> I'm dropping the Fixes tag since the existing code actually works and hence
>>>> there is no need to backport to LTS kernels.
>>>
>>> Sounds reasonable. Alternatively, a line next to it saying
>>>
>>> [Do not backport]
>>>
>>> would work, I guess.
>>>
>>> Greg, I've seen this situation already a few times. A Fixes tag getting
>>> removed to avoid triggering a stable backport. But I think keeping the
>>> Fixes tag could be useful. Should we have a standard way to document
>>> that a patch fixes an old commit without meaning that it should be
>>> backported? Maybe something like this?:
>>>
>>> [Do not backport to stable]
>>> Fixes: ...
>>>
>>> In any case, feel free to remove it.
>>
>> Looks like we have this:
>> There furthermore is a variant of the stable tag you can use to make the
>> stable team’s backporting tools (e.g AUTOSEL or scripts that look for commits
>> containing a ‘Fixes:’ tag) ignore a change:
>> Cc: <stable+noautosel@kernel.org> # reason goes here, and must be present
>>
>> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html#option-1
>>
>> Do you want to re-spin with that?
>
> Would you mind amending to include the following tag?:
>
> Cc: <stable+noautosel@kernel.org> # the code worked by chance
>
> I don't know where I keep the patch, so I'd have to apply it from the
> email to resend. Could you amend it yourself?
sure, I'll amend the patch in my pending branch
/jeff
^ permalink raw reply
* Re: [PATCH v1] wifi: ath9k: Fix typo
From: Jeff Johnson @ 2026-02-24 23:09 UTC (permalink / raw)
To: Alejandro Colomar
Cc: Toke Høiland-Jørgensen, linux-wireless,
Rajkumar Manoharan, John W. Linville, Greg KH
In-Reply-To: <0b9635b8-05ee-4ae4-b4eb-9b83188a0917@oss.qualcomm.com>
On 2/24/2026 3:07 PM, Jeff Johnson wrote:
> On 2/24/2026 2:55 PM, Alejandro Colomar wrote:
>> Hi Jeff,
>>
>> On 2026-02-24T13:34:57-0800, Jeff Johnson wrote:
>>> On 2/24/2026 1:27 PM, Alejandro Colomar wrote:
>>>> Hi Jeff,
>>>>
>>>> On 2026-02-24T10:45:02-0800, Jeff Johnson wrote:
>>>>> On 2/23/2026 7:17 AM, Toke Høiland-Jørgensen wrote:
>>>>>> Alejandro Colomar <alx@kernel.org> writes:
>>>>>>
>>>>>>> This only worked by chance, because all callers of this macro used the
>>>>>>> same identifiers that were expected by the macro.
>>>>>>>
>>>>>>> $ grep -rn ath_for_each_chanctx
>>>>>>> drivers/net/wireless/ath/ath9k/main.c:1576: ath_for_each_chanctx(sc, ctx)
>>>>>>> drivers/net/wireless/ath/ath9k/main.c:2554: ath_for_each_chanctx(sc, ctx) {
>>>>>>> drivers/net/wireless/ath/ath9k/channel.c:165: ath_for_each_chanctx(sc, ctx) {
>>>>>>> drivers/net/wireless/ath/ath9k/channel.c:291: ath_for_each_chanctx(sc, ctx) {
>>>>>>> drivers/net/wireless/ath/ath9k/channel.c:861: ath_for_each_chanctx(sc, ctx) {
>>>>>>> drivers/net/wireless/ath/ath9k/debug.c:717: ath_for_each_chanctx(sc, ctx) {
>>>>>>> drivers/net/wireless/ath/ath9k/ath9k.h:446:#define ath_for_each_chanctx(_sc, _ctx) \
>>>>>>>
>>>>>>> Fixes: c4dc0d040e35 (2014-06-19; "ath9k: Fetch appropriate operating channel context")
>>>>>
>>>>> I'm dropping the Fixes tag since the existing code actually works and hence
>>>>> there is no need to backport to LTS kernels.
>>>>
>>>> Sounds reasonable. Alternatively, a line next to it saying
>>>>
>>>> [Do not backport]
>>>>
>>>> would work, I guess.
>>>>
>>>> Greg, I've seen this situation already a few times. A Fixes tag getting
>>>> removed to avoid triggering a stable backport. But I think keeping the
>>>> Fixes tag could be useful. Should we have a standard way to document
>>>> that a patch fixes an old commit without meaning that it should be
>>>> backported? Maybe something like this?:
>>>>
>>>> [Do not backport to stable]
>>>> Fixes: ...
>>>>
>>>> In any case, feel free to remove it.
>>>
>>> Looks like we have this:
>>> There furthermore is a variant of the stable tag you can use to make the
>>> stable team’s backporting tools (e.g AUTOSEL or scripts that look for commits
>>> containing a ‘Fixes:’ tag) ignore a change:
>>> Cc: <stable+noautosel@kernel.org> # reason goes here, and must be present
>>>
>>> https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html#option-1
>>>
>>> Do you want to re-spin with that?
>>
>> Would you mind amending to include the following tag?:
>>
>> Cc: <stable+noautosel@kernel.org> # the code worked by chance
>>
>> I don't know where I keep the patch, so I'd have to apply it from the
>> email to resend. Could you amend it yourself?
>
> sure, I'll amend the patch in my pending branch
I've also updated the Fixes tag to meet the expected format...
Fixes: c4dc0d040e35 ("ath9k: Fetch appropriate operating channel context")
>
> /jeff
^ permalink raw reply
* Re: [PATCH v1] wifi: ath9k: Fix typo
From: Alejandro Colomar @ 2026-02-24 23:23 UTC (permalink / raw)
To: Jeff Johnson, Greg KH
Cc: Toke Høiland-Jørgensen, linux-wireless,
Rajkumar Manoharan, John W. Linville, Greg KH
In-Reply-To: <828b4d9b-268f-4f7c-ab7c-51aa49c0bde2@oss.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 2609 bytes --]
Hi Jeff, Greg,
On 2026-02-24T15:09:05-0800, Jeff Johnson wrote:
> >> I don't know where I keep the patch, so I'd have to apply it from the
> >> email to resend. Could you amend it yourself?
> >
> > sure, I'll amend the patch in my pending branch
Thanks!
> I've also updated the Fixes tag to meet the expected format...
> Fixes: c4dc0d040e35 ("ath9k: Fetch appropriate operating channel context")
Greg, I CCed you in the man-pages thread where I discussed adding the
commit date to the Fixes tags. I was interested in your opinion, and
also think this could be useful in the kernel.
<https://lore.kernel.org/linux-man/3a656e90329f26d743d0904f56ae847951c852c7.1770150003.git.alx@kernel.org/>
Do you have any opinion about this? Should I send a mail to some kernel
mailing list to propose its use in the kernel?
The format I used is documented in the Linux man-pages here:
<https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/CONTRIBUTING.d/patches/trailer#n16>
Fixes
Add 'Fixes:' tags as necessary. 'Fixes:' trailer fields should
have the following format.
Fixes: 12-char-hash ([author-date,] commit-date; "subject")
where the author date is optional, and only included if it's
somehow important. The commit date is often more important, as
it's sorted, and thus can be used to find (with a binary search)
a commit whose hash and subject may have collisions. For
example:
Fixes: bb509e6fcbae (2020-10-16; "kernel_lockdown.7: New page documenting the Kernel Lockdown feature")
See <CONTRIBUTING.d/git> for how to configure the alias.ref and
alias.ref2 git aliases. The commit references can be produced
with them.
$ git ref bb509e6fc
bb509e6fcbae (2020-10-16; "kernel_lockdown.7: New page documenting the Kernel Lockdown feature")
and here:
<https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/CONTRIBUTING.d/git#n46>
alias.ref, alias.ref2
To produce git commit references, the following git aliases are
useful.
$ git config --global alias.ref \
"show -s --format=tformat:'%C(auto)%h (%cs%x3B \"%s\")%C(reset)'"
$ git config --global alias.ref2 \
"show -s --format=tformat:'%C(auto)%h (%as, %cs%x3B \"%s\")%C(reset)'"
core.abbrev
Use 12 characters in abbreviated hashes.
$ git config --global core.abbrev 12
The Fixes tag I used in this particular patch was
Fixes: c4dc0d040e35 (2014-06-19; "ath9k: Fetch appropriate operating channel context")
Have a lovely night!
Alex
>
> >
> > /jeff
>
--
<https://www.alejandro-colomar.es>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* Re: [PATCH v1] wifi: ath9k: Fix typo
From: Jeff Johnson @ 2026-02-25 0:04 UTC (permalink / raw)
To: Alejandro Colomar, Greg KH
Cc: Toke Høiland-Jørgensen, linux-wireless,
Rajkumar Manoharan, John W. Linville
In-Reply-To: <aZ4xt0TIscdxhseW@devuan>
On 2/24/2026 3:23 PM, Alejandro Colomar wrote:
> Hi Jeff, Greg,
>
> On 2026-02-24T15:09:05-0800, Jeff Johnson wrote:
>>>> I don't know where I keep the patch, so I'd have to apply it from the
>>>> email to resend. Could you amend it yourself?
>>>
>>> sure, I'll amend the patch in my pending branch
>
> Thanks!
>
>> I've also updated the Fixes tag to meet the expected format...
>> Fixes: c4dc0d040e35 ("ath9k: Fetch appropriate operating channel context")
>
> Greg, I CCed you in the man-pages thread where I discussed adding the
> commit date to the Fixes tags. I was interested in your opinion, and
> also think this could be useful in the kernel.
>
> <https://lore.kernel.org/linux-man/3a656e90329f26d743d0904f56ae847951c852c7.1770150003.git.alx@kernel.org/>
>
> Do you have any opinion about this? Should I send a mail to some kernel
> mailing list to propose its use in the kernel?
>
> The format I used is documented in the Linux man-pages here:
> <https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/CONTRIBUTING.d/patches/trailer#n16>
>
> Fixes
> Add 'Fixes:' tags as necessary. 'Fixes:' trailer fields should
> have the following format.
>
> Fixes: 12-char-hash ([author-date,] commit-date; "subject")
>
> where the author date is optional, and only included if it's
> somehow important. The commit date is often more important, as
> it's sorted, and thus can be used to find (with a binary search)
> a commit whose hash and subject may have collisions. For
> example:
>
> Fixes: bb509e6fcbae (2020-10-16; "kernel_lockdown.7: New page documenting the Kernel Lockdown feature")
>
> See <CONTRIBUTING.d/git> for how to configure the alias.ref and
> alias.ref2 git aliases. The commit references can be produced
> with them.
>
> $ git ref bb509e6fc
> bb509e6fcbae (2020-10-16; "kernel_lockdown.7: New page documenting the Kernel Lockdown feature")
>
> and here:
> <https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/CONTRIBUTING.d/git#n46>
>
> alias.ref, alias.ref2
> To produce git commit references, the following git aliases are
> useful.
>
> $ git config --global alias.ref \
> "show -s --format=tformat:'%C(auto)%h (%cs%x3B \"%s\")%C(reset)'"
> $ git config --global alias.ref2 \
> "show -s --format=tformat:'%C(auto)%h (%as, %cs%x3B \"%s\")%C(reset)'"
>
> core.abbrev
> Use 12 characters in abbreviated hashes.
>
> $ git config --global core.abbrev 12
>
> The Fixes tag I used in this particular patch was
>
> Fixes: c4dc0d040e35 (2014-06-19; "ath9k: Fetch appropriate operating channel context")
This format doesn't conform to the format described in:
https://www.kernel.org/doc/html/latest/process/submitting-patches.html
And it fails scripts/checkpatch.pl
Review the comments from when a similar change was proposed (including a
response from Greg):
https://lore.kernel.org/all/tencent_F8CFC8ED723F6E8103B4AF3D98D63D7F1F08@qq.com/
And referencing a project which you authored as an example of how to do things
doesn't give much credibility. Please follow Linux kernel style.
/jeff
^ permalink raw reply
* Re: [PATCH v1] wifi: ath9k: Fix typo
From: Alejandro Colomar @ 2026-02-25 0:10 UTC (permalink / raw)
To: Jeff Johnson
Cc: Greg KH, Toke Høiland-Jørgensen, linux-wireless,
Rajkumar Manoharan, John W. Linville
In-Reply-To: <2ad609dd-bfbc-4af8-88e4-9576708c156d@oss.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 873 bytes --]
Hi Jeff,
On 2026-02-24T16:04:51-0800, Jeff Johnson wrote:
> This format doesn't conform to the format described in:
> https://www.kernel.org/doc/html/latest/process/submitting-patches.html
>
> And it fails scripts/checkpatch.pl
>
> Review the comments from when a similar change was proposed (including a
> response from Greg):
> https://lore.kernel.org/all/tencent_F8CFC8ED723F6E8103B4AF3D98D63D7F1F08@qq.com/
Thanks! I'll reply there.
>
> And referencing a project which you authored as an example of how to do things
> doesn't give much credibility. Please follow Linux kernel style.
Sure; for this patch please use the amended one. I was pointing to that
for discussing changing the format used in the kernel, globally, not to
use it in this patch.
Have a lovely night!
Alex
>
> /jeff
--
<https://www.alejandro-colomar.es>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* RE: [PATCH v3 19/21] wifi: rtl8xxxu: add hw crypto support for AP mode
From: Ping-Ke Shih @ 2026-02-25 2:28 UTC (permalink / raw)
To: Martin Kaistra, Bitterblue Smith, linux-wireless@vger.kernel.org
Cc: Jes Sorensen, Sebastian Andrzej Siewior
In-Reply-To: <b8e9ad0c-c148-40a2-b114-5558e74942b0@linutronix.de>
Martin Kaistra <martin.kaistra@linutronix.de> wrote:
> Am 21.02.26 um 23:09 schrieb Bitterblue Smith:
> > On 22/12/2023 12:14, Martin Kaistra wrote:
> >> Add a custom function for allocating entries in the sec cam. This allows
> >> us to store multiple keys with the same keyidx.
> >>
> >> The maximum number of sec cam entries for 8188f is 16 according to the
> >> vendor driver. Add the number to rtl8xxxu_fileops, so that other chips
> >> which might support more entries, can set a different number there.
> >>
> >> Set the bssid as mac address for group keys instead of just using the
> >> ethernet broadcast address and use BIT(6) in the sec cam ctrl entry
> >> for differentiating them from pairwise keys like in the vendor driver.
> >>
> >> Add the TXDESC_EN_DESC_ID bit and the hw_key_idx to tx
> >> broadcast/multicast packets in AP mode.
> >>
> >> Finally, allow the usage of rtl8xxxu_set_key() for AP mode.
> >>
> >> Signed-off-by: Martin Kaistra <martin.kaistra@linutronix.de>
> >> Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
> >> ---
> >> .../net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 5 ++
> >> .../realtek/rtl8xxxu/rtl8xxxu_8188f.c | 1 +
> >> .../wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 48 +++++++++++++++----
> >> 3 files changed, 44 insertions(+), 10 deletions(-)
> >>
> >> diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
> b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
> >> index c5e6d8f7d26bd..62e6318bc0924 100644
> >> --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
> >> +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
> >> @@ -498,6 +498,7 @@ struct rtl8xxxu_txdesc40 {
> >> #define DESC_RATE_ID_SHIFT 16
> >> #define DESC_RATE_ID_MASK 0xf
> >> #define TXDESC_NAVUSEHDR BIT(20)
> >> +#define TXDESC_EN_DESC_ID BIT(21)
> >> #define TXDESC_SEC_RC4 0x00400000
> >> #define TXDESC_SEC_AES 0x00c00000
> >> #define TXDESC_PKT_OFFSET_SHIFT 26
> >> @@ -1775,6 +1776,7 @@ struct rtl8xxxu_cfo_tracking {
> >> #define RTL8XXXU_MAX_MAC_ID_NUM 128
> >> #define RTL8XXXU_BC_MC_MACID 0
> >> #define RTL8XXXU_BC_MC_MACID1 1
> >> +#define RTL8XXXU_MAX_SEC_CAM_NUM 64
> >>
> >> struct rtl8xxxu_priv {
> >> struct ieee80211_hw *hw;
> >> @@ -1908,6 +1910,7 @@ struct rtl8xxxu_priv {
> >> char led_name[32];
> >> struct led_classdev led_cdev;
> >> DECLARE_BITMAP(mac_id_map, RTL8XXXU_MAX_MAC_ID_NUM);
> >> + DECLARE_BITMAP(cam_map, RTL8XXXU_MAX_SEC_CAM_NUM);
> >> };
> >>
> >> struct rtl8xxxu_sta_info {
> >> @@ -1919,6 +1922,7 @@ struct rtl8xxxu_sta_info {
> >>
> >> struct rtl8xxxu_vif {
> >> int port_num;
> >> + u8 hw_key_idx;
> >> };
> >>
> >> struct rtl8xxxu_rx_urb {
> >> @@ -1993,6 +1997,7 @@ struct rtl8xxxu_fileops {
> >> u16 max_aggr_num;
> >> u8 supports_ap:1;
> >> u16 max_macid_num;
> >> + u16 max_sec_cam_num;
> >> u32 adda_1t_init;
> >> u32 adda_1t_path_on;
> >> u32 adda_2t_path_on_a;
> >> diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c
> b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c
> >> index 1e1c8fa194cb8..574a5fe951543 100644
> >> --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c
> >> +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8188f.c
> >> @@ -1751,6 +1751,7 @@ struct rtl8xxxu_fileops rtl8188fu_fops = {
> >> .max_aggr_num = 0x0c14,
> >> .supports_ap = 1,
> >> .max_macid_num = 16,
> >> + .max_sec_cam_num = 16,
> >> .adda_1t_init = 0x03c00014,
> >> .adda_1t_path_on = 0x03c00014,
> >> .trxff_boundary = 0x3f7f,
> >> diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
> b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
> >> index ecf54eb8dba61..7aafae9fe76b8 100644
> >> --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
> >> +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
> >> @@ -4559,8 +4559,10 @@ static void rtl8xxxu_cam_write(struct rtl8xxxu_priv *priv,
> >> * This is a bit of a hack - the lower bits of the cipher
> >> * suite selector happens to match the cipher index in the CAM
> >> */
> >> - addr = key->keyidx << CAM_CMD_KEY_SHIFT;
> >> + addr = key->hw_key_idx << CAM_CMD_KEY_SHIFT;
> >> ctrl = (key->cipher & 0x0f) << 2 | key->keyidx | CAM_WRITE_VALID;
> >> + if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
> >> + ctrl |= BIT(6);
> >>
> >> for (j = 5; j >= 0; j--) {
> >> switch (j) {
> >> @@ -5546,13 +5548,14 @@ static void rtl8xxxu_tx(struct ieee80211_hw *hw,
> >> struct rtl8xxxu_tx_urb *tx_urb;
> >> struct ieee80211_sta *sta = NULL;
> >> struct ieee80211_vif *vif = tx_info->control.vif;
> >> + struct rtl8xxxu_vif *rtlvif = (struct rtl8xxxu_vif *)vif->drv_priv;
> >> struct device *dev = &priv->udev->dev;
> >> u32 queue, rts_rate;
> >> u16 pktlen = skb->len;
> >> int tx_desc_size = priv->fops->tx_desc_size;
> >> u8 macid;
> >> int ret;
> >> - bool ampdu_enable, sgi = false, short_preamble = false;
> >> + bool ampdu_enable, sgi = false, short_preamble = false, bmc = false;
> >>
> >> if (skb_headroom(skb) < tx_desc_size) {
> >> dev_warn(dev,
> >> @@ -5594,10 +5597,14 @@ static void rtl8xxxu_tx(struct ieee80211_hw *hw,
> >> tx_desc->txdw0 =
> >> TXDESC_OWN | TXDESC_FIRST_SEGMENT | TXDESC_LAST_SEGMENT;
> >> if (is_multicast_ether_addr(ieee80211_get_DA(hdr)) ||
> >> - is_broadcast_ether_addr(ieee80211_get_DA(hdr)))
> >> + is_broadcast_ether_addr(ieee80211_get_DA(hdr))) {
> >> tx_desc->txdw0 |= TXDESC_BROADMULTICAST;
> >> + bmc = true;
> >> + }
> >> +
> >>
> >> tx_desc->txdw1 = cpu_to_le32(queue << TXDESC_QUEUE_SHIFT);
> >> + macid = rtl8xxxu_get_macid(priv, sta);
> >>
> >> if (tx_info->control.hw_key) {
> >> switch (tx_info->control.hw_key->cipher) {
> >> @@ -5612,6 +5619,10 @@ static void rtl8xxxu_tx(struct ieee80211_hw *hw,
> >> default:
> >> break;
> >> }
> >> + if (bmc && rtlvif->hw_key_idx != 0xff) {
> >> + tx_desc->txdw1 |= TXDESC_EN_DESC_ID;
> >> + macid = rtlvif->hw_key_idx;
> >> + }
> >> }
> >>
> >> /* (tx_info->flags & IEEE80211_TX_CTL_AMPDU) && */
> >> @@ -5655,7 +5666,6 @@ static void rtl8xxxu_tx(struct ieee80211_hw *hw,
> >> else
> >> rts_rate = 0;
> >>
> >> - macid = rtl8xxxu_get_macid(priv, sta);
> >> priv->fops->fill_txdesc(hw, hdr, tx_info, tx_desc, sgi, short_preamble,
> >> ampdu_enable, rts_rate, macid);
> >>
> >> @@ -6667,6 +6677,7 @@ static int rtl8xxxu_add_interface(struct ieee80211_hw *hw,
> >>
> >> priv->vifs[port_num] = vif;
> >> rtlvif->port_num = port_num;
> >> + rtlvif->hw_key_idx = 0xff;
> >>
> >> rtl8xxxu_set_linktype(priv, vif->type, port_num);
> >> ether_addr_copy(priv->mac_addr, vif->addr);
> >> @@ -6843,11 +6854,19 @@ static int rtl8xxxu_set_rts_threshold(struct ieee80211_hw *hw, u32 rts)
> >> return 0;
> >> }
> >>
> >> +static int rtl8xxxu_get_free_sec_cam(struct ieee80211_hw *hw)
> >> +{
> >> + struct rtl8xxxu_priv *priv = hw->priv;
> >> +
> >> + return find_first_zero_bit(priv->cam_map, priv->fops->max_sec_cam_num);
> >> +}
> >> +
> >> static int rtl8xxxu_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
> >> struct ieee80211_vif *vif,
> >> struct ieee80211_sta *sta,
> >> struct ieee80211_key_conf *key)
> >> {
> >> + struct rtl8xxxu_vif *rtlvif = (struct rtl8xxxu_vif *)vif->drv_priv;
> >> struct rtl8xxxu_priv *priv = hw->priv;
> >> struct device *dev = &priv->udev->dev;
> >> u8 mac_addr[ETH_ALEN];
> >> @@ -6859,9 +6878,6 @@ static int rtl8xxxu_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
> >> dev_dbg(dev, "%s: cmd %02x, cipher %08x, index %i\n",
> >> __func__, cmd, key->cipher, key->keyidx);
> >>
> >> - if (vif->type != NL80211_IFTYPE_STATION)
> >> - return -EOPNOTSUPP;
> >> -
> >> if (key->keyidx > 3)
> >> return -EOPNOTSUPP;
> >>
> >> @@ -6885,7 +6901,7 @@ static int rtl8xxxu_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
> >> ether_addr_copy(mac_addr, sta->addr);
> >> } else {
> >> dev_dbg(dev, "%s: group key\n", __func__);
> >> - eth_broadcast_addr(mac_addr);
> >> + ether_addr_copy(mac_addr, vif->bss_conf.bssid);
> >> }
> >>
> >> val16 = rtl8xxxu_read16(priv, REG_CR);
> >> @@ -6899,16 +6915,28 @@ static int rtl8xxxu_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
> >>
> >> switch (cmd) {
> >> case SET_KEY:
> >> - key->hw_key_idx = key->keyidx;
> >> +
> >> + retval = rtl8xxxu_get_free_sec_cam(hw);
> >> + if (retval < 0)
> >> + return -EOPNOTSUPP;
> >> +
> >> + key->hw_key_idx = retval;
> >> +
> >> + if (vif->type == NL80211_IFTYPE_AP && !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
> >> + rtlvif->hw_key_idx = key->hw_key_idx;
> >> +
> >> key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
> >> rtl8xxxu_cam_write(priv, key, mac_addr);
> >> + set_bit(key->hw_key_idx, priv->cam_map);
> >
> > Hi Martin,
>
> Hi Bitterblue,
>
> >
> > It turns out RTL8188CUS and RTL8192CU don't like this patch, specifically
> > when we use iwd. After the WPA2 handshake no more data is transmitted.
> >
> > Before this patch, key->hw_key_idx was the same as key->keyidx. After
> > this patch, when we use iwd, the group key is installed first. It has
> > key->keyidx = 1, but it gets key->hw_key_idx = 0. The pairwise key is
> > installed second. It has key->keyidx = 0, but it gets key->hw_key_idx = 1.
> > Both keyidx and hw_key_idx are passed to the chip in rtl8xxxu_cam_write().
> >
> > It's fine with wpa_supplicant. wpa_supplicant installs the pairwise key
> > first, with key->keyidx = 0, then the group key, with key->keyidx = 1.
> >
> > This patch imitating rtw88 makes the old chips work again with iwd.
> > What do you think?
>
> So you reserve the first 4 entries for group keys and use key->keyidx as
> key->hw_key_idx directly for those, right? Does that work if 2 virtual
> interfaces are used at the same time?
> I will do some tests in the next days, but I suspect this be an issue.
Ah. I'm not aware that rtl8xxxu can support 2 virtual interfaces, and
only RTL8188FU declares .supports_concurrent = 1, so maybe we can have
special handling for this chip?
I'd share some information about security CAM for reference. Since data is
quite old (10+ years), I can't guarantee all are correct.
1. default key switch in rtl8xxxu_set_key()
SEC_CFG_TXBC_USE_DEFKEY and SEC_CFG_RXBC_USE_DEFKEY mean that
broadcast/multicast packets use default key (CAM entries 0~3 for
keyidx 0~3).
For two interfaces case, that'd a problem, so maybe we should use
software encryption/decryption for non-pairwise key.
val8 = SEC_CFG_TX_SEC_ENABLE | SEC_CFG_TXBC_USE_DEFKEY |
SEC_CFG_RX_SEC_ENABLE | SEC_CFG_RXBC_USE_DEFKEY;
val8 |= SEC_CFG_TX_USE_DEFKEY | SEC_CFG_RX_USE_DEFKEY;
rtl8xxxu_write8(priv, REG_SECURITY_CFG, val8);
2. group key (GK) field of security CAM in rtl8xxxu_cam_write()
The group key field of security CAM is BIT(6) which isn't supported
by earlier chips (sorry I have no data about the exact chips).
If a chip can support group key field, the CAM layout with default key
enabled for two interfaces (STA-1+AP-1) can be
STA-1 <-> AP-10
AP-1 <-> STA-20
CAM GK MAC KEY
0
1 1 00: AP-1 (GTK) // should be on entry 0~3 depends on key_idx
2
3
4
5 1 AP-10 AP-10 (GTK) // can be on any entry after 4
6
(pairwise key can be on any entry after 4)
if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
ctrl |= BIT(6);
My perspective are
1. currently default key is enabled, so we should treat CAM entry 0~3 as
special cases. That means rtl8xxxu_get_free_sec_cam() should be modified
as Bitterblue's version.
2. For two interfaces, I guess RTL8188FU can support GK bit, so it'd be worth
to try the method of example 2 above.
If we want earlier chips can support two interfaces, I think we should
disable default key. Seemingly, it is not possible that using hardware
crypto when operating one interface and then switching to use software
crypto when operating two interfaces. That means broadcast/multicast
packets should be by software crypto entirely if we want to support two
interfaces.
3. I think rtw88 has similar problem for two interfaces.
>
> >
> > diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c
> b/drivers/net/wireless/realtek/rtl8xxxu/core.c
> > index ee278f0548e4..f7b35655bec5 100644
> > --- a/drivers/net/wireless/realtek/rtl8xxxu/core.c
> > +++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c
> > @@ -6942,7 +6942,8 @@ static int rtl8xxxu_get_free_sec_cam(struct ieee80211_hw *hw)
> > {
> > struct rtl8xxxu_priv *priv = hw->priv;
> >
> > - return find_first_zero_bit(priv->cam_map, priv->fops->max_sec_cam_num);
> > + return find_next_zero_bit(priv->cam_map, priv->fops->max_sec_cam_num,
> > + RTL8XXXU_SEC_DEFAULT_KEY_NUM);
> > }
> >
> > static int rtl8xxxu_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
> > @@ -6999,12 +7000,15 @@ static int rtl8xxxu_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
> >
> > switch (cmd) {
> > case SET_KEY:
> > + if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) {
> > + retval = rtl8xxxu_get_free_sec_cam(hw);
> > + if (retval < 0)
> > + return -EOPNOTSUPP;
> >
> > - retval = rtl8xxxu_get_free_sec_cam(hw);
> > - if (retval < 0)
> > - return -EOPNOTSUPP;
> > -
> > - key->hw_key_idx = retval;
> > + key->hw_key_idx = retval;
> > + } else {
> > + key->hw_key_idx = key->keyidx;
> > + }
> >
> > if (vif->type == NL80211_IFTYPE_AP && !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
> > rtlvif->hw_key_idx = key->hw_key_idx;
> > diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
> b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
> > index 4b05dba22e67..188f4bbe99cd 100644
> > --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
> > +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
> > @@ -1788,6 +1788,7 @@ struct rtl8xxxu_cfo_tracking {
> > #define RTL8XXXU_BC_MC_MACID 0
> > #define RTL8XXXU_BC_MC_MACID1 1
> > #define RTL8XXXU_MAX_SEC_CAM_NUM 64
> > +#define RTL8XXXU_SEC_DEFAULT_KEY_NUM 4
> >
> > struct rtl8xxxu_priv {
> > struct ieee80211_hw *hw;
^ permalink raw reply
* Re: [PATCH] wireless-regdb: Replace M2Crypto with cryptography package
From: Chen-Yu Tsai @ 2026-02-25 7:38 UTC (permalink / raw)
To: Ben Hutchings; +Cc: linux-wireless, wireless-regdb
In-Reply-To: <aZN4FltUUWKUh6rp@decadent.org.uk>
On Tue, Feb 17, 2026 at 4:03 AM Ben Hutchings <benh@debian.org> wrote:
>
> M2Crypto is deprecated by its maintainers in favour of the
> cryptography package. Update db2bin.py to use that for signing
> regulatory.bin.
Cool. This actually forced me to remove Python 2 from my system
to switch over to python3-cryptography. I was using some ancient
version of M2Crypto otherwise.
> Signed-off-by: Ben Hutchings <benh@debian.org>
> ---
> This applies on top of the preceding fix for M2Crypto usage, but I can
> squash them together if it's preferable to switch directly to
> cryptography.
It's fine. Having some history is good.
Thanks
ChenYu
> Ben.
>
> --- a/db2bin.py
> +++ b/db2bin.py
> @@ -2,7 +2,6 @@
>
> from io import BytesIO, open
> import struct
> -import hashlib
> from dbparse import DBParser
> import sys
>
> @@ -125,19 +124,18 @@ if len(sys.argv) > 3:
> # Load RSA only now so people can use this script
> # without having those libraries installed to verify
> # their SQL changes
> - from M2Crypto import RSA
> + from cryptography.hazmat.primitives import hashes, serialization
> + from cryptography.hazmat.primitives.asymmetric import padding
>
> # determine signature length
> - key = RSA.load_key(sys.argv[3])
> - hash = hashlib.sha1()
> - hash.update(output.getvalue())
> - sig = key.sign(hash.digest(), algo='sha1')
> + with open(sys.argv[3], 'rb') as key_file:
> + key = serialization.load_pem_private_key(key_file.read(),
> + password=None)
> + sig = key.sign(output.getvalue(), padding.PKCS1v15(), hashes.SHA1())
> # write it to file
> siglen.set(len(sig))
> # sign again
> - hash = hashlib.sha1()
> - hash.update(output.getvalue())
> - sig = key.sign(hash.digest(), algo='sha1')
> + sig = key.sign(output.getvalue(), padding.PKCS1v15(), hashes.SHA1())
>
> output.write(sig)
> else:
^ permalink raw reply
* Re: [PATCH] wireless-regdb: Fix regulatory.bin signing with new M2Crypto
From: Chen-Yu Tsai @ 2026-02-25 7:40 UTC (permalink / raw)
To: linux-wireless, Ben Hutchings; +Cc: wireless-regdb
In-Reply-To: <aZN3thlmaiBxYVQQ@decadent.org.uk>
On Mon, 16 Feb 2026 21:01:58 +0100, Ben Hutchings wrote:
> In M2Crypto version 0.45.1, the default hash algorithm for
> M2Crypto.RSA.sign() changed from SHA-1 to SHA-256. Since the
> signature on regulatory.bin uses a SHA-1 hash, db2bin.py generates
> invalid signatures for regulatory.bin if a recent version of M2Crypto
> is installed.
>
> I reported this incompatible change as
> <https://todo.sr.ht/~mcepl/m2crypto/389>.
>
> [...]
Applied to master in wens/wireless-regdb.git, thanks!
[1/1] wireless-regdb: Fix regulatory.bin signing with new M2Crypto
https://git.kernel.org/wens/wireless-regdb/c/dcfad17e607c
[1/1] wireless-regdb: Replace M2Crypto with cryptography package
https://git.kernel.org/wens/wireless-regdb/c/88951a4a9b07
Best regards,
--
Chen-Yu Tsai <wens@kernel.org>
^ permalink raw reply
* Re: [RFC PATCH v2 8/8] wifi: mac80211: pass error station if non-STA transmit was requested
From: Benjamin Berg @ 2026-02-25 9:15 UTC (permalink / raw)
To: Ramasamy Kaliappan, linux-wireless; +Cc: Rameshkumar Sundaram
In-Reply-To: <6197fae9-832c-4e48-b8fc-0b14cb44b5b0@oss.qualcomm.com>
On Tue, 2026-02-24 at 23:17 +0530, Ramasamy Kaliappan wrote:
>
>
> On 2/23/2026 6:08 PM, Benjamin Berg wrote:
> > [SNIP]
> > if (!need_offchan) {
> > - ieee80211_tx_skb_tid(sdata, skb, NULL, 7,
> > link_id);
> > + ieee80211_tx_skb_tid(sdata, skb,
> > + sta ? sta : ERR_PTR(-ENOENT),
> Do we need to pass sta here? I didn't see sta actually being used in
> __ieee80211_tx_skb_tid_band().
Uh, it should be.
You are right, in the end I forget to update the call to ieee80211_xmit
to pass sta instead of NULL there.
Benjamin
> > [SNIP]
^ permalink raw reply
* Re: [RFC PATCH v2 2/8] wifi: mac80211: change public RX API to use link stations
From: Berg, Benjamin @ 2026-02-25 9:19 UTC (permalink / raw)
To: linux-wireless@vger.kernel.org,
ramasamy.kaliappan@oss.qualcomm.com
Cc: rameshkumar.sundaram@oss.qualcomm.com
In-Reply-To: <b2679df4-c8e3-43f4-81f3-8434cd9efd12@oss.qualcomm.com>
Hi,
On Tue, 2026-02-24 at 23:11 +0530, Ramasamy Kaliappan wrote:
> On 2/23/2026 6:08 PM, Benjamin Berg wrote:
> > [SNIP]
> > @@ -532,12 +530,11 @@ void ath12k_dp_mon_rx_deliver_msdu(struct ath12k_pdev_dp *dp_pdev,
> > spin_lock_bh(&dp->dp_lock);
> > peer = ath12k_dp_rx_h_find_link_peer(dp_pdev, msdu, &rx_info);
> > if (peer && peer->sta) {
> > - pubsta = peer->sta;
> > - memcpy(addr, peer->addr, ETH_ALEN);
> It appears memcpy of peer address is required, this shouldn't be
> removed, right?
Yup, that was accidental.
Benjamin
> > [SNIP]
Intel Deutschland GmbH
Registered Address: Dornacher Straße 1, 85622 Feldkirchen, Germany
Tel: +49 89 991 430, www.intel.de
Managing Directors: Harry Demas, Jeffrey Schneiderman, Yin Chong Sorrell
Chairperson of the Supervisory Board: Nicole Lau
Registered Seat: Munich
Commercial Register: Amtsgericht München HRB 186928
^ permalink raw reply
* Re: [RFC PATCH v2 7/8] wifi: mac80211: pass station to ieee80211_tx_skb_tid
From: Benjamin Berg @ 2026-02-25 9:28 UTC (permalink / raw)
To: Ramasamy Kaliappan, linux-wireless; +Cc: Rameshkumar Sundaram
In-Reply-To: <fbacd977-ab61-4399-b70f-554abc5afc4d@oss.qualcomm.com>
Hi,
On Tue, 2026-02-24 at 23:15 +0530, Ramasamy Kaliappan wrote:
> [SNIP]
> For the no_sta tx path, The sta lookup happens in ieee80211_tx_prepare()
> (invoked by ieee80211_tx). My understanding is that the skb still ends
> up being queued with a sta. Is that correct?
Right, should have replied here maybe. Obviously, what we want is that
the error number to be passed down to ieee80211_tx_prepare so that it
will not do a station lookup.
The update of the ieee80211_xmit call to pass sta is missing in this
patch version. With that added, ieee80211_tx_prepare should get the
error number and take the branch that sta is not NULL. However, it will
leave rx->sta NULL as it is an error pointer.
At least that is the intention.
Benjamin
^ permalink raw reply
* [patch] wifi: mt76: mt7925: fix incorrect TLV length in CLC command
From: Quan Zhou @ 2026-02-25 9:47 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi
Cc: Sean Wang, Deren Wu, Ryder Lee, Shayne Chen, Leon Yen,
Ming Yen Hsieh, Allan Wang, Sarick Jiang, Posh Sun, Shengxi Xu,
Eric-SY Chang, Michael Lo, CH Yeh, Robin Chiu, linux-wireless,
linux-mediatek, Quan Zhou, stable
The previous implementation of __mt7925_mcu_set_clc() set the TLV length
field (.len) incorrectly during CLC command construction. The length was
initialized as sizeof(req) - 4, regardless of the actual segment length.
This could cause the WiFi firmware to misinterpret the command payload,
resulting in command execution errors.
This patch moves the TLV length assignment to after the segment is
selected, and sets .len to sizeof(req) + seg->len - 4, matching the
actual command content. This ensures the firmware receives the
correct TLV length and parses the command properly.
Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Cc: stable@vger.kernel.org
Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index 1379bf6a26b5..abcdd0e0b3b5 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -3380,7 +3380,6 @@ __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
u8 rsvd[64];
} __packed req = {
.tag = cpu_to_le16(0x3),
- .len = cpu_to_le16(sizeof(req) - 4),
.idx = idx,
.env = env_cap,
@@ -3409,6 +3408,7 @@ __mt7925_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
memcpy(req.type, rule->type, 2);
req.size = cpu_to_le16(seg->len);
+ req.len = cpu_to_le16(sizeof(req) + seg->len - 4);
dev->phy.clc_chan_conf = clc->ver == 1 ? 0xff : rule->flag;
skb = __mt76_mcu_msg_alloc(&dev->mt76, &req,
le16_to_cpu(req.size) + sizeof(req),
--
2.45.2
^ permalink raw reply related
* Re: [PATCH ath-next v4] wifi: ath12k: add basic hwmon temperature reporting
From: Vasanthakumar Thiagarajan @ 2026-02-25 10:52 UTC (permalink / raw)
To: Maharaja Kennadyrajan, ath12k; +Cc: linux-wireless, Aishwarya R
In-Reply-To: <20260223132622.43464-1-maharaja.kennadyrajan@oss.qualcomm.com>
On 2/23/2026 6:56 PM, Maharaja Kennadyrajan wrote:
> Add initial thermal support by wiring up a per-radio (pdev) hwmon temperature
> sensor backed by the existing WMI pdev temperature command and event.
> When userspace reads the sysfs file temp1_input, the driver sends
> WMI_PDEV_GET_TEMPERATURE_CMDID (tag WMI_TAG_PDEV_GET_TEMPERATURE_CMD) and waits
> for the corresponding WMI_PDEV_TEMPERATURE_EVENTID
> (tag WMI_TAG_PDEV_TEMPERATURE_EVENT) to get the temperature and pdev_id.
>
> Export the reported value in millidegrees Celsius as required by hwmon.
> The temperature reported is per-radio (pdev). In a multi-radio wiphy under a
> single phy, a separate hwmon device is created for each radio.
>
> Sample command and output:
> $ cat /sys/devices/pci0000:00/.../ieee80211/phyX/hwmonY/temp1_input
> $ 50000
>
> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
> Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
>
> Reported-by: kernel test robot <lkp@intel.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202602160145.YQdvbqYY-lkp@intel.com/
> Co-developed-by: Aishwarya R <aishwarya.r@oss.qualcomm.com>
> Signed-off-by: Aishwarya R <aishwarya.r@oss.qualcomm.com>
> Signed-off-by: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
^ permalink raw reply
* [GIT PULL] wireless-2026-02-25
From: Johannes Berg @ 2026-02-25 11:30 UTC (permalink / raw)
To: netdev; +Cc: linux-wireless
Hi,
So for some reason a whole bunch of fixes came in recently,
including quite a few (potential) crashes and similar. Most
even are long-standing issues.
Please pull and let us know if there's any problem.
Thanks,
johannes
The following changes since commit 8bf22c33e7a172fbc72464f4cc484d23a6b412ba:
Merge tag 'net-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-02-19 10:39:08 -0800)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git tags/wireless-2026-02-25
for you to fetch changes up to 017c1792525064a723971f0216e6ef86a8c7af11:
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (2026-02-24 10:03:10 +0100)
----------------------------------------------------------------
A good number of fixes:
- cfg80211:
- cancel rfkill work appropriately
- fix radiotap parsing to correctly reject field 18
- fix wext (yes...) off-by-one for IGTK key ID
- mac80211:
- fix for mesh NULL pointer dereference
- fix for stack out-of-bounds (2 bytes) write on
specific multi-link action frames
- set default WMM parameters for all links
- mwifiex: check dev_alloc_name() return value correctly
- libertas: fix potential timer use-after-free
- brcmfmac: fix crash on probe failure
----------------------------------------------------------------
Ariel Silver (1):
wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
Chen-Yu Tsai (1):
wifi: mwifiex: Fix dev_alloc_name() return value check
Daniel Hodges (1):
wifi: libertas: fix use-after-free in lbs_free_adapter()
Daniil Dulov (1):
wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
Johannes Berg (2):
wifi: cfg80211: wext: fix IGTK key ID off-by-one
wifi: radiotap: reject radiotap with unknown bits
Marek Szyprowski (1):
wifi: brcmfmac: Fix potential kernel oops when probe fails
Ramanathan Choodamani (1):
wifi: mac80211: set default WMM parameters on all links
Vahagn Vardanian (1):
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 7 +++----
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 ++++---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h | 2 +-
drivers/net/wireless/marvell/libertas/main.c | 4 ++--
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 +-
net/mac80211/link.c | 2 ++
net/mac80211/mesh.c | 3 +++
net/mac80211/mlme.c | 3 +++
net/wireless/core.c | 1 +
net/wireless/radiotap.c | 4 ++--
net/wireless/wext-compat.c | 2 +-
11 files changed, 23 insertions(+), 14 deletions(-)
^ permalink raw reply
* [PATCH ath-next] wifi: ath12k: Pass the correct value of each TID during a stop AMPDU session
From: Reshma Immaculate Rajkumar @ 2026-02-25 11:49 UTC (permalink / raw)
To: ath12k; +Cc: linux-wireless, Reshma Immaculate Rajkumar
With traffic ongoing for data TID [TID 0], an ADDBA request to
stop AMPDU for the BA session was received on management TID [TID 4].
The corresponding TID number was incorrectly passed to stop the BA session,
resulting in the BA session for data TIDs being stopped and the BA size
being reduced to 1, causing an overall dip in TCP throughput.
Fix this issue by passing the correct argument from
ath12k_dp_rx_ampdu_stop() to ath12k_dp_arch_peer_rx_tid_reo_update()
during an AMPDU stop session. Instead of passing peer->dp_peer->rx_tid,
which is the base address of the array, corresponding to TID 0, pass
the value of &peer->dp_peer->rx_tid[params->tid]. With this, the
different TID numbers are accounted for.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Reshma Immaculate Rajkumar <reshma.rajkumar@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/dp_rx.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c
index a32ee9f8061a..640f752eaa03 100644
--- a/drivers/net/wireless/ath/ath12k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath12k/dp_rx.c
@@ -735,6 +735,7 @@ int ath12k_dp_rx_ampdu_stop(struct ath12k *ar,
struct ath12k_dp *dp = ath12k_ab_to_dp(ab);
struct ath12k_dp_link_peer *peer;
struct ath12k_sta *ahsta = ath12k_sta_to_ahsta(params->sta);
+ struct ath12k_dp_rx_tid *rx_tid;
struct ath12k_link_sta *arsta;
int vdev_id;
bool active;
@@ -770,7 +771,8 @@ int ath12k_dp_rx_ampdu_stop(struct ath12k *ar,
return 0;
}
- ret = ath12k_dp_arch_peer_rx_tid_reo_update(dp, peer, peer->dp_peer->rx_tid,
+ rx_tid = &peer->dp_peer->rx_tid[params->tid];
+ ret = ath12k_dp_arch_peer_rx_tid_reo_update(dp, peer, rx_tid,
1, 0, false);
spin_unlock_bh(&dp->dp_lock);
if (ret) {
base-commit: 8bf22c33e7a172fbc72464f4cc484d23a6b412ba
--
2.34.1
^ permalink raw reply related
* Re: [PATCH ath-next] wifi: ath12k: Pass the correct value of each TID during a stop AMPDU session
From: Pablo MARTIN-GOMEZ @ 2026-02-25 12:57 UTC (permalink / raw)
To: Reshma Immaculate Rajkumar, ath12k; +Cc: linux-wireless
In-Reply-To: <20260225114912.966266-1-reshma.rajkumar@oss.qualcomm.com>
Hello,
On 25/02/2026 12:49, Reshma Immaculate Rajkumar wrote:
> With traffic ongoing for data TID [TID 0], an ADDBA request to
It's a DELBA that is going to be sent to stop a BA session.
> stop AMPDU for the BA session was received on management TID [TID 4].
> The corresponding TID number was incorrectly passed to stop the BA session,
> resulting in the BA session for data TIDs being stopped and the BA size
> being reduced to 1, causing an overall dip in TCP throughput.
I'm guessing you only tested TCP traffic, but UDP throughput is also going to dip.
>
> Fix this issue by passing the correct argument from
> ath12k_dp_rx_ampdu_stop() to ath12k_dp_arch_peer_rx_tid_reo_update()
> during an AMPDU stop session. Instead of passing peer->dp_peer->rx_tid,
> which is the base address of the array, corresponding to TID 0, pass
> the value of &peer->dp_peer->rx_tid[params->tid]. With this, the
> different TID numbers are accounted for.
>
> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1
>
> Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
> Signed-off-by: Reshma Immaculate Rajkumar <reshma.rajkumar@oss.qualcomm.com>
[...]
Pablo MG
^ permalink raw reply
* Re: [PATCH ath-next v4] wifi: ath12k: add basic hwmon temperature reporting
From: Jeff Johnson @ 2026-02-25 14:35 UTC (permalink / raw)
To: Maharaja Kennadyrajan, ath12k; +Cc: linux-wireless, Aishwarya R
In-Reply-To: <20260223132622.43464-1-maharaja.kennadyrajan@oss.qualcomm.com>
On 2/23/2026 5:26 AM, Maharaja Kennadyrajan wrote:
> Reported-by: kernel test robot <lkp@intel.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202602160145.YQdvbqYY-lkp@intel.com/
I'm dropping these tags. In the future please make sure to follow the
instructions provided by the bot:
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202602160145.YQdvbqYY-lkp@intel.com/
/jeff
^ permalink raw reply
* [PATCH] wifi: move action code from per-type frame structs
From: Johannes Berg @ 2026-02-25 16:52 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg
From: Johannes Berg <johannes.berg@intel.com>
The action code actually serves to identify the type of action
frame, so it really isn't part of the per-type structure. Pull
it out and have it in the general action frame format.
In theory, whether or not the action code is present in this
way is up to each category, but all categories that are defined
right now all have that value.
While at it, and since this change requires changing all users,
remove the 'u' and make it an anonymous union in this case, so
that all code using this changes.
Change IEEE80211_MIN_ACTION_SIZE to take an argument which says
how much of the frame is needed, e.g. category, action_code or
the specific frame type that's defined in the union. Again this
also ensures that all code is updated.
In some cases, fix bugs where the SKB length was checked after
having accessed beyond the checked length, in particular in FTM
code, e.g. ieee80211_is_ftm().
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
drivers/net/wireless/ath/ath11k/mac.c | 4 +-
drivers/net/wireless/ath/ath12k/mac.c | 4 +-
drivers/net/wireless/ath/ath12k/wifi7/hw.c | 2 +-
.../wireless/intel/iwlwifi/mld/time_sync.c | 6 +-
.../intel/iwlwifi/mvm/ftm-initiator.c | 7 +-
.../wireless/intel/iwlwifi/mvm/time-sync.c | 6 +-
drivers/net/wireless/marvell/mwifiex/tdls.c | 12 +-
drivers/net/wireless/marvell/mwl8k.c | 4 +-
.../wireless/mediatek/mt76/mt76_connac_mac.c | 4 +-
.../net/wireless/mediatek/mt76/mt7925/mac.c | 2 +-
.../net/wireless/mediatek/mt76/mt7996/mac.c | 2 +-
drivers/net/wireless/realtek/rtl8xxxu/core.c | 14 +-
drivers/net/wireless/realtek/rtlwifi/base.c | 28 ++--
drivers/net/wireless/realtek/rtlwifi/pci.c | 2 +-
include/linux/ieee80211.h | 83 +++++-------
net/mac80211/agg-rx.c | 27 ++--
net/mac80211/agg-tx.c | 28 ++--
net/mac80211/eht.c | 21 ++-
net/mac80211/ht.c | 31 ++---
net/mac80211/ibss.c | 18 +--
net/mac80211/iface.c | 18 +--
net/mac80211/mesh.c | 14 +-
net/mac80211/mesh_hwmp.c | 20 ++-
net/mac80211/mesh_plink.c | 21 ++-
net/mac80211/mlme.c | 82 +++++-------
net/mac80211/rx.c | 123 +++++++-----------
net/mac80211/s1g.c | 28 ++--
net/mac80211/spectmgmt.c | 31 ++---
net/mac80211/tdls.c | 29 ++---
net/mac80211/util.c | 5 +-
net/mac80211/vht.c | 10 +-
31 files changed, 300 insertions(+), 386 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 4dfd08b58416..4abdbfb9c595 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -6282,10 +6282,10 @@ static int ath11k_mac_mgmt_action_frame_fill_elem_data(struct ath11k_vif *arvif,
lockdep_assert_held(&ar->conf_mutex);
/* make sure category field is present */
- if (skb->len < IEEE80211_MIN_ACTION_SIZE)
+ if (skb->len < IEEE80211_MIN_ACTION_SIZE(category))
return -EINVAL;
- remaining_len = skb->len - IEEE80211_MIN_ACTION_SIZE;
+ remaining_len = skb->len - IEEE80211_MIN_ACTION_SIZE(category);
has_protected = ieee80211_has_protected(hdr->frame_control);
/* In case of SW crypto and hdr protected (PMF), packet will already be encrypted,
diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 68431a0e128e..4bd0044b1e80 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -9117,10 +9117,10 @@ static int ath12k_mac_mgmt_action_frame_fill_elem_data(struct ath12k_link_vif *a
lockdep_assert_wiphy(wiphy);
/* make sure category field is present */
- if (skb->len < IEEE80211_MIN_ACTION_SIZE)
+ if (skb->len < IEEE80211_MIN_ACTION_SIZE(category))
return -EINVAL;
- remaining_len = skb->len - IEEE80211_MIN_ACTION_SIZE;
+ remaining_len = skb->len - IEEE80211_MIN_ACTION_SIZE(category);
has_protected = ieee80211_has_protected(hdr->frame_control);
/* In case of SW crypto and hdr protected (PMF), packet will already be encrypted,
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hw.c b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
index df045ddf42da..b1231d04fc2c 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hw.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
@@ -104,7 +104,7 @@ static bool ath12k_is_addba_resp_action_code(struct ieee80211_mgmt *mgmt)
if (mgmt->u.action.category != WLAN_CATEGORY_BACK)
return false;
- if (mgmt->u.action.u.addba_resp.action_code != WLAN_ACTION_ADDBA_RESP)
+ if (mgmt->u.action.action_code != WLAN_ACTION_ADDBA_RESP)
return false;
return true;
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/time_sync.c b/drivers/net/wireless/intel/iwlwifi/mld/time_sync.c
index 50799f9bfccb..76880bbae1df 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/time_sync.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/time_sync.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
- * Copyright (C) 2025 Intel Corporation
+ * Copyright (C) 2025-2026 Intel Corporation
*/
#include "mld.h"
@@ -117,9 +117,9 @@ static bool iwl_mld_is_skb_match(struct sk_buff *skb, u8 *addr, u8 dialog_token)
u8 skb_dialog_token;
if (ieee80211_is_timing_measurement(skb))
- skb_dialog_token = mgmt->u.action.u.wnm_timing_msr.dialog_token;
+ skb_dialog_token = mgmt->u.action.wnm_timing_msr.dialog_token;
else
- skb_dialog_token = mgmt->u.action.u.ftm.dialog_token;
+ skb_dialog_token = mgmt->u.action.ftm.dialog_token;
if ((ether_addr_equal(mgmt->sa, addr) ||
ether_addr_equal(mgmt->da, addr)) &&
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
index a493ef6bedc3..7227df1c653a 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
* Copyright (C) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018-2025 Intel Corporation
+ * Copyright (C) 2018-2026 Intel Corporation
*/
#include <linux/etherdevice.h>
#include <linux/math64.h>
@@ -1409,8 +1409,7 @@ void iwl_mvm_ftm_lc_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
struct iwl_mvm_loc_entry *entry;
const u8 *ies, *lci, *civic, *msr_ie;
size_t ies_len, lci_len = 0, civic_len = 0;
- size_t baselen = IEEE80211_MIN_ACTION_SIZE +
- sizeof(mgmt->u.action.u.ftm);
+ size_t baselen = IEEE80211_MIN_ACTION_SIZE(ftm);
static const u8 rprt_type_lci = IEEE80211_SPCT_MSR_RPRT_TYPE_LCI;
static const u8 rprt_type_civic = IEEE80211_SPCT_MSR_RPRT_TYPE_CIVIC;
@@ -1419,7 +1418,7 @@ void iwl_mvm_ftm_lc_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
lockdep_assert_held(&mvm->mutex);
- ies = mgmt->u.action.u.ftm.variable;
+ ies = mgmt->u.action.ftm.variable;
ies_len = len - baselen;
msr_ie = cfg80211_find_ie_match(WLAN_EID_MEASURE_REPORT, ies, ies_len,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.c
index edae3e24192b..039b4daac73f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-sync.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
- * Copyright (C) 2022 Intel Corporation
+ * Copyright (C) 2022, 2026 Intel Corporation
*/
#include "mvm.h"
@@ -18,9 +18,9 @@ static bool iwl_mvm_is_skb_match(struct sk_buff *skb, u8 *addr, u8 dialog_token)
u8 skb_dialog_token;
if (ieee80211_is_timing_measurement(skb))
- skb_dialog_token = mgmt->u.action.u.wnm_timing_msr.dialog_token;
+ skb_dialog_token = mgmt->u.action.wnm_timing_msr.dialog_token;
else
- skb_dialog_token = mgmt->u.action.u.ftm.dialog_token;
+ skb_dialog_token = mgmt->u.action.ftm.dialog_token;
if ((ether_addr_equal(mgmt->sa, addr) ||
ether_addr_equal(mgmt->da, addr)) &&
diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c
index 77a9a6de636d..95fd5a924226 100644
--- a/drivers/net/wireless/marvell/mwifiex/tdls.c
+++ b/drivers/net/wireless/marvell/mwifiex/tdls.c
@@ -755,16 +755,12 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
switch (action_code) {
case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
/* See the layout of 'struct ieee80211_mgmt'. */
- extra = sizeof(mgmt->u.action.u.tdls_discover_resp) +
- sizeof(mgmt->u.action.category);
+ extra = IEEE80211_MIN_ACTION_SIZE(tdls_discover_resp) - 24;
skb_put(skb, extra);
mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
- mgmt->u.action.u.tdls_discover_resp.action_code =
- WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
- mgmt->u.action.u.tdls_discover_resp.dialog_token =
- dialog_token;
- mgmt->u.action.u.tdls_discover_resp.capability =
- cpu_to_le16(capab);
+ mgmt->u.action.action_code = WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
+ mgmt->u.action.tdls_discover_resp.dialog_token = dialog_token;
+ mgmt->u.action.tdls_discover_resp.capability = cpu_to_le16(capab);
/* move back for addr4 */
memmove(pos + ETH_ALEN, &mgmt->u.action, extra);
/* init address 4 */
diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
index 54d6d00ecdf1..e43614df2164 100644
--- a/drivers/net/wireless/marvell/mwl8k.c
+++ b/drivers/net/wireless/marvell/mwl8k.c
@@ -1985,9 +1985,9 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw,
*/
if (unlikely(ieee80211_is_action(wh->frame_control) &&
mgmt->u.action.category == WLAN_CATEGORY_BACK &&
- mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ &&
+ mgmt->u.action.action_code == WLAN_ACTION_ADDBA_REQ &&
priv->ap_fw)) {
- u16 capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
+ u16 capab = le16_to_cpu(mgmt->u.action.addba_req.capab);
tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
index = mwl8k_tid_queue_mapping(tid);
}
diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
index 3304b5971be0..38e17f0da1a9 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
@@ -414,8 +414,8 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
if (ieee80211_is_action(fc) &&
mgmt->u.action.category == WLAN_CATEGORY_BACK &&
- mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {
- u16 capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
+ mgmt->u.action.action_code == WLAN_ACTION_ADDBA_REQ) {
+ u16 capab = le16_to_cpu(mgmt->u.action.addba_req.capab);
txwi[5] |= cpu_to_le32(MT_TXD5_ADD_BA);
tid = (capab >> 2) & IEEE80211_QOS_CTL_TID_MASK;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
index 871b67101976..01dfdb687af5 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mac.c
@@ -669,7 +669,7 @@ mt7925_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
if (ieee80211_is_action(fc) &&
mgmt->u.action.category == WLAN_CATEGORY_BACK &&
- mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ)
+ mgmt->u.action.action_code == WLAN_ACTION_ADDBA_REQ)
tid = MT_TX_ADDBA;
else if (ieee80211_is_mgmt(hdr->frame_control))
tid = MT_TX_NORMAL;
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index 2560e2f46e89..e78febee9721 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -801,7 +801,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
if (ieee80211_is_action(fc) &&
mgmt->u.action.category == WLAN_CATEGORY_BACK &&
- mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {
+ mgmt->u.action.action_code == WLAN_ACTION_ADDBA_REQ) {
if (is_mt7990(&dev->mt76))
txwi[6] |= cpu_to_le32(FIELD_PREP(MT_TXD6_TID_ADDBA, tid));
else
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c b/drivers/net/wireless/realtek/rtl8xxxu/core.c
index f9a527f6a175..7b1080df8dfc 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c
@@ -5146,10 +5146,10 @@ static void rtl8xxxu_dump_action(struct device *dev,
if (!(rtl8xxxu_debug & RTL8XXXU_DEBUG_ACTION))
return;
- switch (mgmt->u.action.u.addba_resp.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_ACTION_ADDBA_RESP:
- cap = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
- timeout = le16_to_cpu(mgmt->u.action.u.addba_resp.timeout);
+ cap = le16_to_cpu(mgmt->u.action.addba_resp.capab);
+ timeout = le16_to_cpu(mgmt->u.action.addba_resp.timeout);
dev_info(dev, "WLAN_ACTION_ADDBA_RESP: "
"timeout %i, tid %02x, buf_size %02x, policy %02x, "
"status %02x\n",
@@ -5157,11 +5157,11 @@ static void rtl8xxxu_dump_action(struct device *dev,
(cap & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2,
(cap & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6,
(cap >> 1) & 0x1,
- le16_to_cpu(mgmt->u.action.u.addba_resp.status));
+ le16_to_cpu(mgmt->u.action.addba_resp.status));
break;
case WLAN_ACTION_ADDBA_REQ:
- cap = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
- timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
+ cap = le16_to_cpu(mgmt->u.action.addba_req.capab);
+ timeout = le16_to_cpu(mgmt->u.action.addba_req.timeout);
dev_info(dev, "WLAN_ACTION_ADDBA_REQ: "
"timeout %i, tid %02x, buf_size %02x, policy %02x\n",
timeout,
@@ -5171,7 +5171,7 @@ static void rtl8xxxu_dump_action(struct device *dev,
break;
default:
dev_info(dev, "action frame %02x\n",
- mgmt->u.action.u.addba_resp.action_code);
+ mgmt->u.action.action_code);
break;
}
}
diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
index 09e5a16d7252..fdf482233d5e 100644
--- a/drivers/net/wireless/realtek/rtlwifi/base.c
+++ b/drivers/net/wireless/realtek/rtlwifi/base.c
@@ -1409,7 +1409,7 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
sta_entry =
(struct rtl_sta_info *)sta->drv_priv;
capab =
- le16_to_cpu(mgmt->u.action.u.addba_req.capab);
+ le16_to_cpu(mgmt->u.action.addba_req.capab);
tid = (capab &
IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
if (tid >= MAX_TID_COUNT) {
@@ -2392,35 +2392,35 @@ static struct sk_buff *rtl_make_smps_action(struct ieee80211_hw *hw,
struct sk_buff *skb;
struct ieee80211_mgmt *action_frame;
- /* 27 = header + category + action + smps mode */
- skb = dev_alloc_skb(27 + hw->extra_tx_headroom);
+ skb = dev_alloc_skb(IEEE80211_MIN_ACTION_SIZE(ht_smps) +
+ hw->extra_tx_headroom);
if (!skb)
return NULL;
skb_reserve(skb, hw->extra_tx_headroom);
- action_frame = skb_put_zero(skb, 27);
+ action_frame = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE(ht_smps));
memcpy(action_frame->da, da, ETH_ALEN);
memcpy(action_frame->sa, rtlefuse->dev_addr, ETH_ALEN);
memcpy(action_frame->bssid, bssid, ETH_ALEN);
action_frame->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION);
action_frame->u.action.category = WLAN_CATEGORY_HT;
- action_frame->u.action.u.ht_smps.action = WLAN_HT_ACTION_SMPS;
+ action_frame->u.action.action_code = WLAN_HT_ACTION_SMPS;
switch (smps) {
case IEEE80211_SMPS_AUTOMATIC:/* 0 */
case IEEE80211_SMPS_NUM_MODES:/* 4 */
WARN_ON(1);
fallthrough;
case IEEE80211_SMPS_OFF:/* 1 */ /*MIMO_PS_NOLIMIT*/
- action_frame->u.action.u.ht_smps.smps_control =
+ action_frame->u.action.ht_smps.smps_control =
WLAN_HT_SMPS_CONTROL_DISABLED;/* 0 */
break;
case IEEE80211_SMPS_STATIC:/* 2 */ /*MIMO_PS_STATIC*/
- action_frame->u.action.u.ht_smps.smps_control =
+ action_frame->u.action.ht_smps.smps_control =
WLAN_HT_SMPS_CONTROL_STATIC;/* 1 */
break;
case IEEE80211_SMPS_DYNAMIC:/* 3 */ /*MIMO_PS_DYNAMIC*/
- action_frame->u.action.u.ht_smps.smps_control =
+ action_frame->u.action.ht_smps.smps_control =
WLAN_HT_SMPS_CONTROL_DYNAMIC;/* 3 */
break;
}
@@ -2519,25 +2519,25 @@ struct sk_buff *rtl_make_del_ba(struct ieee80211_hw *hw,
struct ieee80211_mgmt *action_frame;
u16 params;
- /* 27 = header + category + action + smps mode */
- skb = dev_alloc_skb(34 + hw->extra_tx_headroom);
+ skb = dev_alloc_skb(IEEE80211_MIN_ACTION_SIZE(delba) +
+ hw->extra_tx_headroom);
if (!skb)
return NULL;
skb_reserve(skb, hw->extra_tx_headroom);
- action_frame = skb_put_zero(skb, 34);
+ action_frame = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE(delba));
memcpy(action_frame->sa, sa, ETH_ALEN);
memcpy(action_frame->da, rtlefuse->dev_addr, ETH_ALEN);
memcpy(action_frame->bssid, bssid, ETH_ALEN);
action_frame->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION);
action_frame->u.action.category = WLAN_CATEGORY_BACK;
- action_frame->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
+ action_frame->u.action.action_code = WLAN_ACTION_DELBA;
params = (u16)(1 << 11); /* bit 11 initiator */
params |= (u16)(tid << 12); /* bit 15:12 TID number */
- action_frame->u.action.u.delba.params = cpu_to_le16(params);
- action_frame->u.action.u.delba.reason_code =
+ action_frame->u.action.delba.params = cpu_to_le16(params);
+ action_frame->u.action.delba.reason_code =
cpu_to_le16(WLAN_REASON_QSTA_TIMEOUT);
return skb;
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index d080469264cf..19e2ff62d9f1 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -507,7 +507,7 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
if (ieee80211_is_action(fc)) {
struct ieee80211_mgmt *action_frame =
(struct ieee80211_mgmt *)skb->data;
- if (action_frame->u.action.u.ht_smps.action ==
+ if (action_frame->u.action.action_code ==
WLAN_HT_ACTION_SMPS) {
dev_kfree_skb(skb);
goto tx_status_ok;
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 0aa2fb8f88de..0c5c847f72a8 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1046,31 +1046,28 @@ struct ieee80211_mgmt {
} __packed probe_resp;
struct {
u8 category;
+ u8 action_code;
union {
struct {
- u8 action_code;
u8 dialog_token;
u8 status_code;
u8 variable[];
} __packed wme_action;
struct{
- u8 action_code;
+ u8 no_fixed_fields[0];
u8 variable[];
} __packed chan_switch;
struct{
- u8 action_code;
struct ieee80211_ext_chansw_ie data;
u8 variable[];
} __packed ext_chan_switch;
struct{
- u8 action_code;
u8 dialog_token;
u8 element_id;
u8 length;
struct ieee80211_msrment_ie msr_elem;
} __packed measurement;
struct{
- u8 action_code;
u8 dialog_token;
__le16 capab;
__le16 timeout;
@@ -1079,7 +1076,6 @@ struct ieee80211_mgmt {
u8 variable[];
} __packed addba_req;
struct{
- u8 action_code;
u8 dialog_token;
__le16 status;
__le16 capab;
@@ -1088,54 +1084,45 @@ struct ieee80211_mgmt {
u8 variable[];
} __packed addba_resp;
struct{
- u8 action_code;
__le16 params;
__le16 reason_code;
} __packed delba;
struct {
- u8 action_code;
+ u8 no_fixed_fields[0];
u8 variable[];
} __packed self_prot;
struct{
- u8 action_code;
+ u8 no_fixed_fields[0];
u8 variable[];
} __packed mesh_action;
struct {
- u8 action;
u8 trans_id[WLAN_SA_QUERY_TR_ID_LEN];
} __packed sa_query;
struct {
- u8 action;
u8 smps_control;
} __packed ht_smps;
struct {
- u8 action_code;
u8 chanwidth;
} __packed ht_notify_cw;
struct {
- u8 action_code;
u8 dialog_token;
__le16 capability;
u8 variable[];
} __packed tdls_discover_resp;
struct {
- u8 action_code;
u8 operating_mode;
} __packed vht_opmode_notif;
struct {
- u8 action_code;
u8 membership[WLAN_MEMBERSHIP_LEN];
u8 position[WLAN_USER_POSITION_LEN];
} __packed vht_group_notif;
struct {
- u8 action_code;
u8 dialog_token;
u8 tpc_elem_id;
u8 tpc_elem_length;
struct ieee80211_tpc_report_ie tpc;
} __packed tpc_report;
struct {
- u8 action_code;
u8 dialog_token;
u8 follow_up;
u8 tod[6];
@@ -1145,11 +1132,10 @@ struct ieee80211_mgmt {
u8 variable[];
} __packed ftm;
struct {
- u8 action_code;
+ u8 no_fixed_fields[0];
u8 variable[];
} __packed s1g;
struct {
- u8 action_code;
u8 dialog_token;
u8 follow_up;
u32 tod;
@@ -1158,41 +1144,37 @@ struct ieee80211_mgmt {
u8 max_toa_error;
} __packed wnm_timing_msr;
struct {
- u8 action_code;
u8 dialog_token;
u8 variable[];
} __packed ttlm_req;
struct {
- u8 action_code;
u8 dialog_token;
__le16 status_code;
u8 variable[];
} __packed ttlm_res;
struct {
- u8 action_code;
+ u8 no_fixed_fields[0];
+ /* no variable fields either */
} __packed ttlm_tear_down;
struct {
- u8 action_code;
u8 dialog_token;
u8 variable[];
} __packed ml_reconf_req;
struct {
- u8 action_code;
u8 dialog_token;
u8 count;
u8 variable[];
} __packed ml_reconf_resp;
struct {
- u8 action_code;
+ u8 no_fixed_fields[0];
u8 variable[];
} __packed epcs;
struct {
- u8 action_code;
u8 dialog_token;
u8 control;
u8 variable[];
} __packed eml_omn;
- } u;
+ };
} __packed action;
DECLARE_FLEX_ARRAY(u8, body); /* Generic frame body */
} u;
@@ -1210,8 +1192,7 @@ struct ieee80211_mgmt {
#define BSS_MEMBERSHIP_SELECTOR_MIN BSS_MEMBERSHIP_SELECTOR_UHR_PHY
-/* mgmt header + 1 byte category code */
-#define IEEE80211_MIN_ACTION_SIZE offsetof(struct ieee80211_mgmt, u.action.u)
+#define IEEE80211_MIN_ACTION_SIZE(type) offsetofend(struct ieee80211_mgmt, u.action.type)
/* Management MIC information element (IEEE 802.11w) for CMAC */
@@ -2389,7 +2370,7 @@ static inline bool ieee80211_is_bufferable_mmpdu(struct sk_buff *skb)
if (!ieee80211_is_action(fc))
return false;
- if (skb->len < offsetofend(typeof(*mgmt), u.action.u.ftm.action_code))
+ if (skb->len < IEEE80211_MIN_ACTION_SIZE(action_code))
return true;
/* action frame - additionally check for non-bufferable FTM */
@@ -2398,8 +2379,8 @@ static inline bool ieee80211_is_bufferable_mmpdu(struct sk_buff *skb)
mgmt->u.action.category != WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
return true;
- if (mgmt->u.action.u.ftm.action_code == WLAN_PUB_ACTION_FTM_REQUEST ||
- mgmt->u.action.u.ftm.action_code == WLAN_PUB_ACTION_FTM_RESPONSE)
+ if (mgmt->u.action.action_code == WLAN_PUB_ACTION_FTM_REQUEST ||
+ mgmt->u.action.action_code == WLAN_PUB_ACTION_FTM_RESPONSE)
return false;
return true;
@@ -2449,7 +2430,7 @@ static inline bool _ieee80211_is_robust_mgmt_frame(struct ieee80211_hdr *hdr)
*/
static inline bool ieee80211_is_robust_mgmt_frame(struct sk_buff *skb)
{
- if (skb->len < IEEE80211_MIN_ACTION_SIZE)
+ if (skb->len < IEEE80211_MIN_ACTION_SIZE(category))
return false;
return _ieee80211_is_robust_mgmt_frame((void *)skb->data);
}
@@ -2465,7 +2446,7 @@ static inline bool ieee80211_is_public_action(struct ieee80211_hdr *hdr,
{
struct ieee80211_mgmt *mgmt = (void *)hdr;
- if (len < IEEE80211_MIN_ACTION_SIZE)
+ if (len < IEEE80211_MIN_ACTION_SIZE(category))
return false;
if (!ieee80211_is_action(hdr->frame_control))
return false;
@@ -2483,13 +2464,14 @@ static inline bool ieee80211_is_public_action(struct ieee80211_hdr *hdr,
static inline bool
ieee80211_is_protected_dual_of_public_action(struct sk_buff *skb)
{
+ struct ieee80211_mgmt *mgmt = (void *)skb->data;
u8 action;
if (!ieee80211_is_public_action((void *)skb->data, skb->len) ||
- skb->len < IEEE80211_MIN_ACTION_SIZE + 1)
+ skb->len < IEEE80211_MIN_ACTION_SIZE(action_code))
return false;
- action = *(u8 *)(skb->data + IEEE80211_MIN_ACTION_SIZE);
+ action = mgmt->u.action.action_code;
return action != WLAN_PUB_ACTION_20_40_BSS_COEX &&
action != WLAN_PUB_ACTION_DSE_REG_LOC_ANN &&
@@ -2528,7 +2510,7 @@ static inline bool _ieee80211_is_group_privacy_action(struct ieee80211_hdr *hdr)
*/
static inline bool ieee80211_is_group_privacy_action(struct sk_buff *skb)
{
- if (skb->len < IEEE80211_MIN_ACTION_SIZE)
+ if (skb->len < IEEE80211_MIN_ACTION_SIZE(category))
return false;
return _ieee80211_is_group_privacy_action((void *)skb->data);
}
@@ -2624,8 +2606,7 @@ static inline bool ieee80211_action_contains_tpc(struct sk_buff *skb)
if (!ieee80211_is_action(mgmt->frame_control))
return false;
- if (skb->len < IEEE80211_MIN_ACTION_SIZE +
- sizeof(mgmt->u.action.u.tpc_report))
+ if (skb->len < IEEE80211_MIN_ACTION_SIZE(tpc_report))
return false;
/*
@@ -2644,12 +2625,11 @@ static inline bool ieee80211_action_contains_tpc(struct sk_buff *skb)
return false;
/* both spectrum mgmt and link measurement have same action code */
- if (mgmt->u.action.u.tpc_report.action_code !=
- WLAN_ACTION_SPCT_TPC_RPRT)
+ if (mgmt->u.action.action_code != WLAN_ACTION_SPCT_TPC_RPRT)
return false;
- if (mgmt->u.action.u.tpc_report.tpc_elem_id != WLAN_EID_TPC_REPORT ||
- mgmt->u.action.u.tpc_report.tpc_elem_length !=
+ if (mgmt->u.action.tpc_report.tpc_elem_id != WLAN_EID_TPC_REPORT ||
+ mgmt->u.action.tpc_report.tpc_elem_length !=
sizeof(struct ieee80211_tpc_report_ie))
return false;
@@ -2665,16 +2645,15 @@ static inline bool ieee80211_is_timing_measurement(struct sk_buff *skb)
{
struct ieee80211_mgmt *mgmt = (void *)skb->data;
- if (skb->len < IEEE80211_MIN_ACTION_SIZE)
+ if (skb->len < IEEE80211_MIN_ACTION_SIZE(wnm_timing_msr))
return false;
if (!ieee80211_is_action(mgmt->frame_control))
return false;
if (mgmt->u.action.category == WLAN_CATEGORY_WNM_UNPROTECTED &&
- mgmt->u.action.u.wnm_timing_msr.action_code ==
- WLAN_UNPROTECTED_WNM_ACTION_TIMING_MEASUREMENT_RESPONSE &&
- skb->len >= offsetofend(typeof(*mgmt), u.action.u.wnm_timing_msr))
+ mgmt->u.action.action_code ==
+ WLAN_UNPROTECTED_WNM_ACTION_TIMING_MEASUREMENT_RESPONSE)
return true;
return false;
@@ -2689,15 +2668,13 @@ static inline bool ieee80211_is_ftm(struct sk_buff *skb)
{
struct ieee80211_mgmt *mgmt = (void *)skb->data;
+ if (skb->len < IEEE80211_MIN_ACTION_SIZE(ftm))
+ return false;
+
if (!ieee80211_is_public_action((void *)mgmt, skb->len))
return false;
- if (mgmt->u.action.u.ftm.action_code ==
- WLAN_PUB_ACTION_FTM_RESPONSE &&
- skb->len >= offsetofend(typeof(*mgmt), u.action.u.ftm))
- return true;
-
- return false;
+ return mgmt->u.action.action_code == WLAN_PUB_ACTION_FTM_RESPONSE;
}
struct element {
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 7da909d78c68..45e3a5d7b93d 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -9,7 +9,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2007-2010, Intel Corporation
* Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018-2025 Intel Corporation
+ * Copyright (C) 2018-2026 Intel Corporation
*/
/**
@@ -251,19 +251,20 @@ static void ieee80211_send_addba_resp(struct sta_info *sta, u8 *da, u16 tid,
skb_reserve(skb, local->hw.extra_tx_headroom);
mgmt = ieee80211_mgmt_ba(skb, da, sdata);
- skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_resp));
+ skb_put(skb, 2 + sizeof(mgmt->u.action.addba_resp));
mgmt->u.action.category = WLAN_CATEGORY_BACK;
- mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
- mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
+ mgmt->u.action.action_code = WLAN_ACTION_ADDBA_RESP;
+
+ mgmt->u.action.addba_resp.dialog_token = dialog_token;
capab = u16_encode_bits(amsdu, IEEE80211_ADDBA_PARAM_AMSDU_MASK);
capab |= u16_encode_bits(policy, IEEE80211_ADDBA_PARAM_POLICY_MASK);
capab |= u16_encode_bits(tid, IEEE80211_ADDBA_PARAM_TID_MASK);
capab |= u16_encode_bits(buf_size, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
- mgmt->u.action.u.addba_resp.capab = cpu_to_le16(capab);
- mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
- mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
+ mgmt->u.action.addba_resp.capab = cpu_to_le16(capab);
+ mgmt->u.action.addba_resp.timeout = cpu_to_le16(timeout);
+ mgmt->u.action.addba_resp.status = cpu_to_le16(status);
if (sta->sta.valid_links || sta->sta.deflink.he_cap.has_he)
ieee80211_add_addbaext(skb, req_addba_ext_data, buf_size);
@@ -477,22 +478,22 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
u8 dialog_token, addba_ext_data;
/* extract session parameters from addba request frame */
- dialog_token = mgmt->u.action.u.addba_req.dialog_token;
- timeout = le16_to_cpu(mgmt->u.action.u.addba_req.timeout);
+ dialog_token = mgmt->u.action.addba_req.dialog_token;
+ timeout = le16_to_cpu(mgmt->u.action.addba_req.timeout);
start_seq_num =
- le16_to_cpu(mgmt->u.action.u.addba_req.start_seq_num) >> 4;
+ le16_to_cpu(mgmt->u.action.addba_req.start_seq_num) >> 4;
- capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
+ capab = le16_to_cpu(mgmt->u.action.addba_req.capab);
ba_policy = (capab & IEEE80211_ADDBA_PARAM_POLICY_MASK) >> 1;
tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
addba_ext_data =
ieee80211_retrieve_addba_ext_data(sta,
- mgmt->u.action.u.addba_req.variable,
+ mgmt->u.action.addba_req.variable,
len -
offsetof(typeof(*mgmt),
- u.action.u.addba_req.variable),
+ u.action.addba_req.variable),
&buf_size);
__ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index d981b0fc57bf..de68f7da6f39 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -9,7 +9,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2007-2010, Intel Corporation
* Copyright(c) 2015-2017 Intel Deutschland GmbH
- * Copyright (C) 2018 - 2024 Intel Corporation
+ * Copyright (C) 2018-2026 Intel Corporation
*/
#include <linux/ieee80211.h>
@@ -68,7 +68,7 @@ static void ieee80211_send_addba_request(struct sta_info *sta, u16 tid,
struct ieee80211_mgmt *mgmt;
u16 capab;
- skb = dev_alloc_skb(sizeof(*mgmt) +
+ skb = dev_alloc_skb(IEEE80211_MIN_ACTION_SIZE(addba_req) +
2 + sizeof(struct ieee80211_addba_ext_ie) +
local->hw.extra_tx_headroom);
if (!skb)
@@ -77,21 +77,21 @@ static void ieee80211_send_addba_request(struct sta_info *sta, u16 tid,
skb_reserve(skb, local->hw.extra_tx_headroom);
mgmt = ieee80211_mgmt_ba(skb, sta->sta.addr, sdata);
- skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
+ skb_put(skb, 2 + sizeof(mgmt->u.action.addba_req));
mgmt->u.action.category = WLAN_CATEGORY_BACK;
- mgmt->u.action.u.addba_req.action_code = WLAN_ACTION_ADDBA_REQ;
+ mgmt->u.action.action_code = WLAN_ACTION_ADDBA_REQ;
- mgmt->u.action.u.addba_req.dialog_token = dialog_token;
+ mgmt->u.action.addba_req.dialog_token = dialog_token;
capab = IEEE80211_ADDBA_PARAM_AMSDU_MASK;
capab |= IEEE80211_ADDBA_PARAM_POLICY_MASK;
capab |= u16_encode_bits(tid, IEEE80211_ADDBA_PARAM_TID_MASK);
capab |= u16_encode_bits(agg_size, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
- mgmt->u.action.u.addba_req.capab = cpu_to_le16(capab);
+ mgmt->u.action.addba_req.capab = cpu_to_le16(capab);
- mgmt->u.action.u.addba_req.timeout = cpu_to_le16(timeout);
- mgmt->u.action.u.addba_req.start_seq_num =
+ mgmt->u.action.addba_req.timeout = cpu_to_le16(timeout);
+ mgmt->u.action.addba_req.start_seq_num =
cpu_to_le16(start_seq_num << 4);
if (sta->sta.deflink.he_cap.has_he)
@@ -978,15 +978,15 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
lockdep_assert_wiphy(sta->local->hw.wiphy);
- capab = le16_to_cpu(mgmt->u.action.u.addba_resp.capab);
+ capab = le16_to_cpu(mgmt->u.action.addba_resp.capab);
amsdu = capab & IEEE80211_ADDBA_PARAM_AMSDU_MASK;
tid = u16_get_bits(capab, IEEE80211_ADDBA_PARAM_TID_MASK);
buf_size = u16_get_bits(capab, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
ieee80211_retrieve_addba_ext_data(sta,
- mgmt->u.action.u.addba_resp.variable,
+ mgmt->u.action.addba_resp.variable,
len - offsetof(typeof(*mgmt),
- u.action.u.addba_resp.variable),
+ u.action.addba_resp.variable),
&buf_size);
buf_size = min(buf_size, local->hw.max_tx_aggregation_subframes);
@@ -999,7 +999,7 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
if (!tid_tx)
return;
- if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) {
+ if (mgmt->u.action.addba_resp.dialog_token != tid_tx->dialog_token) {
ht_dbg(sta->sdata, "wrong addBA response token, %pM tid %d\n",
sta->sta.addr, tid);
return;
@@ -1029,7 +1029,7 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
* is set to 0, the Buffer Size subfield is set to a value
* of at least 1.
*/
- if (le16_to_cpu(mgmt->u.action.u.addba_resp.status)
+ if (le16_to_cpu(mgmt->u.action.addba_resp.status)
== WLAN_STATUS_SUCCESS && buf_size) {
if (test_and_set_bit(HT_AGG_STATE_RESPONSE_RECEIVED,
&tid_tx->state)) {
@@ -1046,7 +1046,7 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
sta->ampdu_mlme.addba_req_num[tid] = 0;
tid_tx->timeout =
- le16_to_cpu(mgmt->u.action.u.addba_resp.timeout);
+ le16_to_cpu(mgmt->u.action.addba_resp.timeout);
if (tid_tx->timeout) {
mod_timer(&tid_tx->session_timer,
diff --git a/net/mac80211/eht.c b/net/mac80211/eht.c
index 75096b2195d2..ae594e77dbef 100644
--- a/net/mac80211/eht.c
+++ b/net/mac80211/eht.c
@@ -108,7 +108,7 @@ static void
ieee80211_send_eml_op_mode_notif(struct ieee80211_sub_if_data *sdata,
struct ieee80211_mgmt *req, int opt_len)
{
- int len = offsetofend(struct ieee80211_mgmt, u.action.u.eml_omn);
+ int len = IEEE80211_MIN_ACTION_SIZE(eml_omn);
struct ieee80211_local *local = sdata->local;
struct ieee80211_mgmt *mgmt;
struct sk_buff *skb;
@@ -127,16 +127,15 @@ ieee80211_send_eml_op_mode_notif(struct ieee80211_sub_if_data *sdata,
memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
- mgmt->u.action.u.eml_omn.action_code =
- WLAN_PROTECTED_EHT_ACTION_EML_OP_MODE_NOTIF;
- mgmt->u.action.u.eml_omn.dialog_token =
- req->u.action.u.eml_omn.dialog_token;
- mgmt->u.action.u.eml_omn.control = req->u.action.u.eml_omn.control &
+ mgmt->u.action.action_code = WLAN_PROTECTED_EHT_ACTION_EML_OP_MODE_NOTIF;
+ mgmt->u.action.eml_omn.dialog_token =
+ req->u.action.eml_omn.dialog_token;
+ mgmt->u.action.eml_omn.control = req->u.action.eml_omn.control &
~(IEEE80211_EML_CTRL_EMLSR_PARAM_UPDATE |
IEEE80211_EML_CTRL_INDEV_COEX_ACT);
/* Copy optional fields from the received notification frame */
- memcpy(mgmt->u.action.u.eml_omn.variable,
- req->u.action.u.eml_omn.variable, opt_len);
+ memcpy(mgmt->u.action.eml_omn.variable,
+ req->u.action.eml_omn.variable, opt_len);
ieee80211_tx_skb(sdata, skb);
}
@@ -144,14 +143,14 @@ ieee80211_send_eml_op_mode_notif(struct ieee80211_sub_if_data *sdata,
void ieee80211_rx_eml_op_mode_notif(struct ieee80211_sub_if_data *sdata,
struct sk_buff *skb)
{
- int len = offsetofend(struct ieee80211_mgmt, u.action.u.eml_omn);
+ int len = IEEE80211_MIN_ACTION_SIZE(eml_omn);
enum nl80211_iftype type = ieee80211_vif_type_p2p(&sdata->vif);
struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
const struct wiphy_iftype_ext_capab *ift_ext_capa;
struct ieee80211_mgmt *mgmt = (void *)skb->data;
struct ieee80211_local *local = sdata->local;
- u8 control = mgmt->u.action.u.eml_omn.control;
- u8 *ptr = mgmt->u.action.u.eml_omn.variable;
+ u8 control = mgmt->u.action.eml_omn.control;
+ u8 *ptr = mgmt->u.action.eml_omn.variable;
struct ieee80211_eml_params eml_params = {
.link_id = status->link_id,
};
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 1c82a28b03de..9e2469a8ce64 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -9,7 +9,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2007-2010, Intel Corporation
* Copyright 2017 Intel Deutschland GmbH
- * Copyright(c) 2020-2025 Intel Corporation
+ * Copyright(c) 2020-2026 Intel Corporation
*/
#include <linux/ieee80211.h>
@@ -462,22 +462,23 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
struct ieee80211_mgmt *mgmt;
u16 params;
- skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+ skb = dev_alloc_skb(IEEE80211_MIN_ACTION_SIZE(delba) +
+ local->hw.extra_tx_headroom);
if (!skb)
return;
skb_reserve(skb, local->hw.extra_tx_headroom);
mgmt = ieee80211_mgmt_ba(skb, da, sdata);
- skb_put(skb, 1 + sizeof(mgmt->u.action.u.delba));
+ skb_put(skb, 2 + sizeof(mgmt->u.action.delba));
mgmt->u.action.category = WLAN_CATEGORY_BACK;
- mgmt->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
+ mgmt->u.action.action_code = WLAN_ACTION_DELBA;
params = (u16)(initiator << 11); /* bit 11 initiator */
params |= (u16)(tid << 12); /* bit 15:12 TID number */
- mgmt->u.action.u.delba.params = cpu_to_le16(params);
- mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
+ mgmt->u.action.delba.params = cpu_to_le16(params);
+ mgmt->u.action.delba.reason_code = cpu_to_le16(reason_code);
ieee80211_tx_skb(sdata, skb);
}
@@ -489,14 +490,14 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
u16 tid, params;
u16 initiator;
- params = le16_to_cpu(mgmt->u.action.u.delba.params);
+ params = le16_to_cpu(mgmt->u.action.delba.params);
tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
ht_dbg_ratelimited(sdata, "delba from %pM (%s) tid %d reason code %d\n",
mgmt->sa, initiator ? "initiator" : "recipient",
tid,
- le16_to_cpu(mgmt->u.action.u.delba.reason_code));
+ le16_to_cpu(mgmt->u.action.delba.reason_code));
if (initiator == WLAN_BACK_INITIATOR)
__ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_INITIATOR, 0,
@@ -530,20 +531,20 @@ int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
struct ieee80211_tx_info *info;
u8 status_link_id = link_id < 0 ? 0 : link_id;
- /* 27 = header + category + action + smps mode */
- skb = dev_alloc_skb(27 + local->hw.extra_tx_headroom);
+ skb = dev_alloc_skb(IEEE80211_MIN_ACTION_SIZE(ht_smps) +
+ local->hw.extra_tx_headroom);
if (!skb)
return -ENOMEM;
skb_reserve(skb, local->hw.extra_tx_headroom);
- action_frame = skb_put(skb, 27);
+ action_frame = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE(ht_smps));
memcpy(action_frame->da, da, ETH_ALEN);
memcpy(action_frame->sa, sdata->dev->dev_addr, ETH_ALEN);
memcpy(action_frame->bssid, bssid, ETH_ALEN);
action_frame->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION);
action_frame->u.action.category = WLAN_CATEGORY_HT;
- action_frame->u.action.u.ht_smps.action = WLAN_HT_ACTION_SMPS;
+ action_frame->u.action.action_code = WLAN_HT_ACTION_SMPS;
switch (smps) {
case IEEE80211_SMPS_AUTOMATIC:
case IEEE80211_SMPS_NUM_MODES:
@@ -551,15 +552,15 @@ int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
smps = IEEE80211_SMPS_OFF;
fallthrough;
case IEEE80211_SMPS_OFF:
- action_frame->u.action.u.ht_smps.smps_control =
+ action_frame->u.action.ht_smps.smps_control =
WLAN_HT_SMPS_CONTROL_DISABLED;
break;
case IEEE80211_SMPS_STATIC:
- action_frame->u.action.u.ht_smps.smps_control =
+ action_frame->u.action.ht_smps.smps_control =
WLAN_HT_SMPS_CONTROL_STATIC;
break;
case IEEE80211_SMPS_DYNAMIC:
- action_frame->u.action.u.ht_smps.smps_control =
+ action_frame->u.action.ht_smps.smps_control =
WLAN_HT_SMPS_CONTROL_DYNAMIC;
break;
}
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 168f84a1353b..0298272c37ec 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -9,7 +9,7 @@
* Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
* Copyright 2013-2014 Intel Mobile Communications GmbH
* Copyright(c) 2016 Intel Deutschland GmbH
- * Copyright(c) 2018-2025 Intel Corporation
+ * Copyright(c) 2018-2026 Intel Corporation
*/
#include <linux/delay.h>
@@ -888,19 +888,11 @@ ieee80211_rx_mgmt_spectrum_mgmt(struct ieee80211_sub_if_data *sdata,
struct ieee80211_rx_status *rx_status,
struct ieee802_11_elems *elems)
{
- int required_len;
-
- if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+ if (len < IEEE80211_MIN_ACTION_SIZE(chan_switch))
return;
/* CSA is the only action we handle for now */
- if (mgmt->u.action.u.measurement.action_code !=
- WLAN_ACTION_SPCT_CHL_SWITCH)
- return;
-
- required_len = IEEE80211_MIN_ACTION_SIZE +
- sizeof(mgmt->u.action.u.chan_switch);
- if (len < required_len)
+ if (mgmt->u.action.action_code != WLAN_ACTION_SPCT_CHL_SWITCH)
return;
if (!sdata->vif.bss_conf.csa_active)
@@ -1613,12 +1605,12 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
case WLAN_CATEGORY_SPECTRUM_MGMT:
ies_len = skb->len -
offsetof(struct ieee80211_mgmt,
- u.action.u.chan_switch.variable);
+ u.action.chan_switch.variable);
if (ies_len < 0)
break;
- elems = ieee802_11_parse_elems(mgmt->u.action.u.chan_switch.variable,
+ elems = ieee802_11_parse_elems(mgmt->u.action.chan_switch.variable,
ies_len,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 676b2a43c9f2..2e391cec73a0 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1579,7 +1579,7 @@ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
sta = sta_info_get_bss(sdata, mgmt->sa);
if (sta) {
- switch (mgmt->u.action.u.addba_req.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_ACTION_ADDBA_REQ:
ieee80211_process_addba_request(local, sta,
mgmt, len);
@@ -1599,9 +1599,9 @@ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
}
} else if (ieee80211_is_action(mgmt->frame_control) &&
mgmt->u.action.category == WLAN_CATEGORY_HT) {
- switch (mgmt->u.action.u.ht_smps.action) {
+ switch (mgmt->u.action.action_code) {
case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
- u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
+ u8 chanwidth = mgmt->u.action.ht_notify_cw.chanwidth;
struct ieee80211_rx_status *status;
struct link_sta_info *link_sta;
struct sta_info *sta;
@@ -1628,7 +1628,7 @@ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
}
} else if (ieee80211_is_action(mgmt->frame_control) &&
mgmt->u.action.category == WLAN_CATEGORY_VHT) {
- switch (mgmt->u.action.u.vht_group_notif.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_VHT_ACTION_OPMODE_NOTIF: {
struct ieee80211_rx_status *status;
enum nl80211_band band;
@@ -1637,7 +1637,7 @@ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
status = IEEE80211_SKB_RXCB(skb);
band = status->band;
- opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
+ opmode = mgmt->u.action.vht_opmode_notif.operating_mode;
sta = sta_info_get_bss(sdata, mgmt->sa);
@@ -1658,7 +1658,7 @@ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
}
} else if (ieee80211_is_action(mgmt->frame_control) &&
mgmt->u.action.category == WLAN_CATEGORY_S1G) {
- switch (mgmt->u.action.u.s1g.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_S1G_TWT_TEARDOWN:
case WLAN_S1G_TWT_SETUP:
ieee80211_s1g_rx_twt_action(sdata, skb);
@@ -1669,7 +1669,7 @@ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
} else if (ieee80211_is_action(mgmt->frame_control) &&
mgmt->u.action.category == WLAN_CATEGORY_PROTECTED_EHT) {
if (sdata->vif.type == NL80211_IFTYPE_AP) {
- switch (mgmt->u.action.u.eml_omn.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_PROTECTED_EHT_ACTION_EML_OP_MODE_NOTIF:
ieee80211_rx_eml_op_mode_notif(sdata, skb);
break;
@@ -1677,7 +1677,7 @@ static void ieee80211_iface_process_skb(struct ieee80211_local *local,
break;
}
} else if (sdata->vif.type == NL80211_IFTYPE_STATION) {
- switch (mgmt->u.action.u.ttlm_req.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_PROTECTED_EHT_ACTION_TTLM_REQ:
ieee80211_process_neg_ttlm_req(sdata, mgmt,
skb->len);
@@ -1765,7 +1765,7 @@ static void ieee80211_iface_process_status(struct ieee80211_sub_if_data *sdata,
if (ieee80211_is_action(mgmt->frame_control) &&
mgmt->u.action.category == WLAN_CATEGORY_S1G) {
- switch (mgmt->u.action.u.s1g.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_S1G_TWT_TEARDOWN:
case WLAN_S1G_TWT_SETUP:
ieee80211_s1g_status_twt_action(sdata, skb);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 68901f1def0d..ccbf33fb23bd 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2008, 2009 open80211s Ltd.
- * Copyright (C) 2018 - 2025 Intel Corporation
+ * Copyright (C) 2018-2026 Intel Corporation
* Authors: Luis Carlos Cobo <luisca@cozybit.com>
* Javier Cardona <javier@cozybit.com>
*/
@@ -19,8 +19,7 @@ static struct kmem_cache *rm_cache;
bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt)
{
- return (mgmt->u.action.u.mesh_action.action_code ==
- WLAN_MESH_ACTION_HWMP_PATH_SELECTION);
+ return mgmt->u.action.action_code == WLAN_MESH_ACTION_HWMP_PATH_SELECTION;
}
void ieee80211s_init(void)
@@ -1619,13 +1618,12 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
size_t baselen;
u8 *pos;
- if (mgmt->u.action.u.measurement.action_code !=
- WLAN_ACTION_SPCT_CHL_SWITCH)
+ if (mgmt->u.action.action_code != WLAN_ACTION_SPCT_CHL_SWITCH)
return;
- pos = mgmt->u.action.u.chan_switch.variable;
+ pos = mgmt->u.action.chan_switch.variable;
baselen = offsetof(struct ieee80211_mgmt,
- u.action.u.chan_switch.variable);
+ u.action.chan_switch.variable);
elems = ieee802_11_parse_elems(pos, len - baselen,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
@@ -1668,7 +1666,7 @@ static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
{
switch (mgmt->u.action.category) {
case WLAN_CATEGORY_SELF_PROTECTED:
- switch (mgmt->u.action.u.self_prot.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_SP_MESH_PEERING_OPEN:
case WLAN_SP_MESH_PEERING_CLOSE:
case WLAN_SP_MESH_PEERING_CONFIRM:
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index a41b57bd11ff..dad311e0833a 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2008, 2009 open80211s Ltd.
- * Copyright (C) 2019, 2021-2023, 2025 Intel Corporation
+ * Copyright (C) 2019, 2021-2023, 2025-2026 Intel Corporation
* Author: Luis Carlos Cobo <luisca@cozybit.com>
*/
@@ -105,12 +105,11 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
u32 lifetime, u32 metric, u32 preq_id,
struct ieee80211_sub_if_data *sdata)
{
+ int hdr_len = IEEE80211_MIN_ACTION_SIZE(mesh_action);
struct ieee80211_local *local = sdata->local;
struct sk_buff *skb;
struct ieee80211_mgmt *mgmt;
u8 *pos, ie_len;
- int hdr_len = offsetofend(struct ieee80211_mgmt,
- u.action.u.mesh_action);
skb = dev_alloc_skb(local->tx_headroom +
hdr_len +
@@ -127,8 +126,7 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
/* BSSID == SA */
memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
mgmt->u.action.category = WLAN_CATEGORY_MESH_ACTION;
- mgmt->u.action.u.mesh_action.action_code =
- WLAN_MESH_ACTION_HWMP_PATH_SELECTION;
+ mgmt->u.action.action_code = WLAN_MESH_ACTION_HWMP_PATH_SELECTION;
switch (action) {
case MPATH_PREQ:
@@ -237,13 +235,12 @@ int mesh_path_error_tx(struct ieee80211_sub_if_data *sdata,
u8 ttl, const u8 *target, u32 target_sn,
u16 target_rcode, const u8 *ra)
{
+ int hdr_len = IEEE80211_MIN_ACTION_SIZE(mesh_action);
struct ieee80211_local *local = sdata->local;
struct sk_buff *skb;
struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
struct ieee80211_mgmt *mgmt;
u8 *pos, ie_len;
- int hdr_len = offsetofend(struct ieee80211_mgmt,
- u.action.u.mesh_action);
if (time_before(jiffies, ifmsh->next_perr))
return -EAGAIN;
@@ -265,8 +262,7 @@ int mesh_path_error_tx(struct ieee80211_sub_if_data *sdata,
/* BSSID == SA */
memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
mgmt->u.action.category = WLAN_CATEGORY_MESH_ACTION;
- mgmt->u.action.u.mesh_action.action_code =
- WLAN_MESH_ACTION_HWMP_PATH_SELECTION;
+ mgmt->u.action.action_code = WLAN_MESH_ACTION_HWMP_PATH_SELECTION;
ie_len = 15;
pos = skb_put(skb, 2 + ie_len);
*pos++ = WLAN_EID_PERR;
@@ -938,7 +934,7 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
struct sta_info *sta;
/* need action_code */
- if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+ if (len < IEEE80211_MIN_ACTION_SIZE(mesh_action))
return;
rcu_read_lock();
@@ -949,8 +945,8 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
}
rcu_read_unlock();
- baselen = (u8 *) mgmt->u.action.u.mesh_action.variable - (u8 *) mgmt;
- elems = ieee802_11_parse_elems(mgmt->u.action.u.mesh_action.variable,
+ baselen = mgmt->u.action.mesh_action.variable - (u8 *)mgmt;
+ elems = ieee802_11_parse_elems(mgmt->u.action.mesh_action.variable,
len - baselen,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 04c931cd2063..7d823a55636f 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2008, 2009 open80211s Ltd.
- * Copyright (C) 2019, 2021-2025 Intel Corporation
+ * Copyright (C) 2019, 2021-2026 Intel Corporation
* Author: Luis Carlos Cobo <luisca@cozybit.com>
*/
#include <linux/gfp.h>
@@ -13,7 +13,7 @@
#include "rate.h"
#include "mesh.h"
-#define PLINK_CNF_AID(mgmt) ((mgmt)->u.action.u.self_prot.variable + 2)
+#define PLINK_CNF_AID(mgmt) ((mgmt)->u.action.self_prot.variable + 2)
#define PLINK_GET_LLID(p) (p + 2)
#define PLINK_GET_PLID(p) (p + 4)
@@ -215,6 +215,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
enum ieee80211_self_protected_actioncode action,
u8 *da, u16 llid, u16 plid, u16 reason)
{
+ int hdr_len = IEEE80211_MIN_ACTION_SIZE(self_prot);
struct ieee80211_local *local = sdata->local;
struct sk_buff *skb;
struct ieee80211_tx_info *info;
@@ -223,7 +224,6 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
u16 peering_proto = 0;
u8 *pos, ie_len = 4;
u8 ie_len_he_cap, ie_len_eht_cap;
- int hdr_len = offsetofend(struct ieee80211_mgmt, u.action.u.self_prot);
int err = -ENOMEM;
ie_len_he_cap = ieee80211_ie_len_he_cap(sdata);
@@ -260,7 +260,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
mgmt->u.action.category = WLAN_CATEGORY_SELF_PROTECTED;
- mgmt->u.action.u.self_prot.action_code = action;
+ mgmt->u.action.action_code = action;
if (action != WLAN_SP_MESH_PEERING_CLOSE) {
struct ieee80211_supported_band *sband;
@@ -1141,7 +1141,7 @@ mesh_process_plink_frame(struct ieee80211_sub_if_data *sdata,
return;
}
- ftype = mgmt->u.action.u.self_prot.action_code;
+ ftype = mgmt->u.action.action_code;
if ((ftype == WLAN_SP_MESH_PEERING_OPEN && ie_len != 4) ||
(ftype == WLAN_SP_MESH_PEERING_CONFIRM && ie_len != 6) ||
(ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len != 6
@@ -1224,8 +1224,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
size_t baselen;
u8 *baseaddr;
- /* need action_code, aux */
- if (len < IEEE80211_MIN_ACTION_SIZE + 3)
+ /* need aux */
+ if (len < IEEE80211_MIN_ACTION_SIZE(self_prot) + 1)
return;
if (sdata->u.mesh.user_mpm)
@@ -1238,10 +1238,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
return;
}
- baseaddr = mgmt->u.action.u.self_prot.variable;
- baselen = (u8 *) mgmt->u.action.u.self_prot.variable - (u8 *) mgmt;
- if (mgmt->u.action.u.self_prot.action_code ==
- WLAN_SP_MESH_PEERING_CONFIRM) {
+ baseaddr = mgmt->u.action.self_prot.variable;
+ baselen = mgmt->u.action.self_prot.variable - (u8 *)mgmt;
+ if (mgmt->u.action.action_code == WLAN_SP_MESH_PEERING_CONFIRM) {
baseaddr += 4;
baselen += 4;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index e83582b2c377..995855d49822 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -7897,7 +7897,7 @@ ieee80211_send_neg_ttlm_req(struct ieee80211_sub_if_data *sdata,
struct ieee80211_local *local = sdata->local;
struct ieee80211_mgmt *mgmt;
struct sk_buff *skb;
- int hdr_len = offsetofend(struct ieee80211_mgmt, u.action.u.ttlm_req);
+ int hdr_len = IEEE80211_MIN_ACTION_SIZE(ttlm_req);
int ttlm_max_len = 2 + 1 + sizeof(struct ieee80211_ttlm_elem) + 1 +
2 * 2 * IEEE80211_TTLM_NUM_TIDS;
@@ -7914,9 +7914,8 @@ ieee80211_send_neg_ttlm_req(struct ieee80211_sub_if_data *sdata,
memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
- mgmt->u.action.u.ttlm_req.action_code =
- WLAN_PROTECTED_EHT_ACTION_TTLM_REQ;
- mgmt->u.action.u.ttlm_req.dialog_token = dialog_token;
+ mgmt->u.action.action_code = WLAN_PROTECTED_EHT_ACTION_TTLM_REQ;
+ mgmt->u.action.ttlm_req.dialog_token = dialog_token;
ieee80211_neg_ttlm_add_suggested_map(skb, neg_ttlm);
ieee80211_tx_skb(sdata, skb);
}
@@ -7966,7 +7965,7 @@ ieee80211_send_neg_ttlm_res(struct ieee80211_sub_if_data *sdata,
struct ieee80211_local *local = sdata->local;
struct ieee80211_mgmt *mgmt;
struct sk_buff *skb;
- int hdr_len = offsetofend(struct ieee80211_mgmt, u.action.u.ttlm_res);
+ int hdr_len = IEEE80211_MIN_ACTION_SIZE(ttlm_res);
int ttlm_max_len = 2 + 1 + sizeof(struct ieee80211_ttlm_elem) + 1 +
2 * 2 * IEEE80211_TTLM_NUM_TIDS;
u16 status_code;
@@ -7984,9 +7983,8 @@ ieee80211_send_neg_ttlm_res(struct ieee80211_sub_if_data *sdata,
memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
- mgmt->u.action.u.ttlm_res.action_code =
- WLAN_PROTECTED_EHT_ACTION_TTLM_RES;
- mgmt->u.action.u.ttlm_res.dialog_token = dialog_token;
+ mgmt->u.action.action_code = WLAN_PROTECTED_EHT_ACTION_TTLM_RES;
+ mgmt->u.action.ttlm_res.dialog_token = dialog_token;
switch (ttlm_res) {
default:
WARN_ON(1);
@@ -8003,7 +8001,7 @@ ieee80211_send_neg_ttlm_res(struct ieee80211_sub_if_data *sdata,
break;
}
- mgmt->u.action.u.ttlm_res.status_code = cpu_to_le16(status_code);
+ mgmt->u.action.ttlm_res.status_code = cpu_to_le16(status_code);
ieee80211_tx_skb(sdata, skb);
}
@@ -8103,10 +8101,9 @@ void ieee80211_process_neg_ttlm_req(struct ieee80211_sub_if_data *sdata,
if (!ieee80211_vif_is_mld(&sdata->vif))
return;
- dialog_token = mgmt->u.action.u.ttlm_req.dialog_token;
- ies_len = len - offsetof(struct ieee80211_mgmt,
- u.action.u.ttlm_req.variable);
- elems = ieee802_11_parse_elems(mgmt->u.action.u.ttlm_req.variable,
+ dialog_token = mgmt->u.action.ttlm_req.dialog_token;
+ ies_len = len - IEEE80211_MIN_ACTION_SIZE(ttlm_req);
+ elems = ieee802_11_parse_elems(mgmt->u.action.ttlm_req.variable,
ies_len,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
@@ -8157,8 +8154,7 @@ void ieee80211_process_neg_ttlm_res(struct ieee80211_sub_if_data *sdata,
struct ieee80211_mgmt *mgmt, size_t len)
{
if (!ieee80211_vif_is_mld(&sdata->vif) ||
- mgmt->u.action.u.ttlm_req.dialog_token !=
- sdata->u.mgd.dialog_token_alloc)
+ mgmt->u.action.ttlm_res.dialog_token != sdata->u.mgd.dialog_token_alloc)
return;
wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
@@ -8172,7 +8168,7 @@ void ieee80211_process_neg_ttlm_res(struct ieee80211_sub_if_data *sdata,
* This can be better implemented in the future, to handle request
* rejections.
*/
- if (le16_to_cpu(mgmt->u.action.u.ttlm_res.status_code) != WLAN_STATUS_SUCCESS)
+ if (le16_to_cpu(mgmt->u.action.ttlm_res.status_code) != WLAN_STATUS_SUCCESS)
__ieee80211_disconnect(sdata);
}
@@ -8205,12 +8201,11 @@ static void ieee80211_teardown_ttlm_work(struct wiphy *wiphy,
void ieee80211_send_teardown_neg_ttlm(struct ieee80211_vif *vif)
{
+ int frame_len = IEEE80211_MIN_ACTION_SIZE(ttlm_tear_down);
struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
struct ieee80211_local *local = sdata->local;
struct ieee80211_mgmt *mgmt;
struct sk_buff *skb;
- int frame_len = offsetofend(struct ieee80211_mgmt,
- u.action.u.ttlm_tear_down);
struct ieee80211_tx_info *info;
skb = dev_alloc_skb(local->hw.extra_tx_headroom + frame_len);
@@ -8226,8 +8221,7 @@ void ieee80211_send_teardown_neg_ttlm(struct ieee80211_vif *vif)
memcpy(mgmt->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
- mgmt->u.action.u.ttlm_tear_down.action_code =
- WLAN_PROTECTED_EHT_ACTION_TTLM_TEARDOWN;
+ mgmt->u.action.action_code = WLAN_PROTECTED_EHT_ACTION_TTLM_TEARDOWN;
info = IEEE80211_SKB_CB(skb);
info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
@@ -8310,13 +8304,13 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
case WLAN_CATEGORY_SPECTRUM_MGMT:
ies_len = skb->len -
offsetof(struct ieee80211_mgmt,
- u.action.u.chan_switch.variable);
+ u.action.chan_switch.variable);
if (ies_len < 0)
break;
/* CSA IE cannot be overridden, no need for BSSID */
- elems = ieee802_11_parse_elems(mgmt->u.action.u.chan_switch.variable,
+ elems = ieee802_11_parse_elems(mgmt->u.action.chan_switch.variable,
ies_len,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
@@ -8338,7 +8332,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
case WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION:
ies_len = skb->len -
offsetof(struct ieee80211_mgmt,
- u.action.u.ext_chan_switch.variable);
+ u.action.ext_chan_switch.variable);
if (ies_len < 0)
break;
@@ -8347,7 +8341,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
* extended CSA IE can't be overridden, no need for
* BSSID
*/
- elems = ieee802_11_parse_elems(mgmt->u.action.u.ext_chan_switch.variable,
+ elems = ieee802_11_parse_elems(mgmt->u.action.ext_chan_switch.variable,
ies_len,
IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION,
@@ -8364,7 +8358,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
/* for the handling code pretend it was an IE */
elems->ext_chansw_ie =
- &mgmt->u.action.u.ext_chan_switch.data;
+ &mgmt->u.action.ext_chan_switch.data;
ieee80211_sta_process_chanswitch(link,
rx_status->mactime,
@@ -10356,25 +10350,25 @@ void ieee80211_process_ml_reconf_resp(struct ieee80211_sub_if_data *sdata,
u8 *pos;
if (!ieee80211_vif_is_mld(&sdata->vif) ||
- len < offsetofend(typeof(*mgmt), u.action.u.ml_reconf_resp) ||
- mgmt->u.action.u.ml_reconf_resp.dialog_token !=
- sdata->u.mgd.reconf.dialog_token ||
+ len < IEEE80211_MIN_ACTION_SIZE(ml_reconf_resp) ||
+ mgmt->u.action.ml_reconf_resp.dialog_token !=
+ sdata->u.mgd.reconf.dialog_token ||
!sta_changed_links)
return;
- pos = mgmt->u.action.u.ml_reconf_resp.variable;
- len -= offsetofend(typeof(*mgmt), u.action.u.ml_reconf_resp);
+ pos = mgmt->u.action.ml_reconf_resp.variable;
+ len -= offsetofend(typeof(*mgmt), u.action.ml_reconf_resp);
/* each status duple is 3 octets */
- if (len < mgmt->u.action.u.ml_reconf_resp.count * 3) {
+ if (len < mgmt->u.action.ml_reconf_resp.count * 3) {
sdata_info(sdata,
"mlo: reconf: unexpected len=%zu, count=%u\n",
- len, mgmt->u.action.u.ml_reconf_resp.count);
+ len, mgmt->u.action.ml_reconf_resp.count);
goto disconnect;
}
link_mask = sta_changed_links;
- for (i = 0; i < mgmt->u.action.u.ml_reconf_resp.count; i++) {
+ for (i = 0; i < mgmt->u.action.ml_reconf_resp.count; i++) {
u16 status = get_unaligned_le16(pos + 1);
link_id = *pos;
@@ -10659,8 +10653,7 @@ ieee80211_build_ml_reconf_req(struct ieee80211_sub_if_data *sdata,
return NULL;
skb_reserve(skb, local->hw.extra_tx_headroom);
- mgmt = skb_put_zero(skb, offsetofend(struct ieee80211_mgmt,
- u.action.u.ml_reconf_req));
+ mgmt = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE(ml_reconf_req));
/* Add the MAC header */
mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
@@ -10671,12 +10664,11 @@ ieee80211_build_ml_reconf_req(struct ieee80211_sub_if_data *sdata,
/* Add the action frame fixed fields */
mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
- mgmt->u.action.u.ml_reconf_req.action_code =
- WLAN_PROTECTED_EHT_ACTION_LINK_RECONFIG_REQ;
+ mgmt->u.action.action_code = WLAN_PROTECTED_EHT_ACTION_LINK_RECONFIG_REQ;
/* allocate a dialog token and store it */
sdata->u.mgd.reconf.dialog_token = ++sdata->u.mgd.dialog_token_alloc;
- mgmt->u.action.u.ml_reconf_req.dialog_token =
+ mgmt->u.action.ml_reconf_req.dialog_token =
sdata->u.mgd.reconf.dialog_token;
/* Add the ML reconfiguration element and the common information */
@@ -11046,11 +11038,10 @@ static bool ieee80211_mgd_epcs_supp(struct ieee80211_sub_if_data *sdata)
int ieee80211_mgd_set_epcs(struct ieee80211_sub_if_data *sdata, bool enable)
{
+ int frame_len = IEEE80211_MIN_ACTION_SIZE(epcs) + (enable ? 1 : 0);
struct ieee80211_local *local = sdata->local;
struct ieee80211_mgmt *mgmt;
struct sk_buff *skb;
- int frame_len = offsetofend(struct ieee80211_mgmt,
- u.action.u.epcs) + (enable ? 1 : 0);
if (!ieee80211_mgd_epcs_supp(sdata))
return -EINVAL;
@@ -11079,15 +11070,15 @@ int ieee80211_mgd_set_epcs(struct ieee80211_sub_if_data *sdata, bool enable)
mgmt->u.action.category = WLAN_CATEGORY_PROTECTED_EHT;
if (enable) {
- u8 *pos = mgmt->u.action.u.epcs.variable;
+ u8 *pos = mgmt->u.action.epcs.variable;
- mgmt->u.action.u.epcs.action_code =
+ mgmt->u.action.action_code =
WLAN_PROTECTED_EHT_ACTION_EPCS_ENABLE_REQ;
*pos = ++sdata->u.mgd.dialog_token_alloc;
sdata->u.mgd.epcs.dialog_token = *pos;
} else {
- mgmt->u.action.u.epcs.action_code =
+ mgmt->u.action.action_code =
WLAN_PROTECTED_EHT_ACTION_EPCS_ENABLE_TEARDOWN;
ieee80211_epcs_teardown(sdata);
@@ -11176,7 +11167,7 @@ void ieee80211_process_epcs_ena_resp(struct ieee80211_sub_if_data *sdata,
return;
/* Handle dialog token and status code */
- pos = mgmt->u.action.u.epcs.variable;
+ pos = mgmt->u.action.epcs.variable;
dialog_token = *pos;
status_code = get_unaligned_le16(pos + 1);
@@ -11198,8 +11189,7 @@ void ieee80211_process_epcs_ena_resp(struct ieee80211_sub_if_data *sdata,
return;
pos += IEEE80211_EPCS_ENA_RESP_BODY_LEN;
- ies_len = len - offsetof(struct ieee80211_mgmt,
- u.action.u.epcs.variable) -
+ ies_len = len - IEEE80211_MIN_ACTION_SIZE(epcs) -
IEEE80211_EPCS_ENA_RESP_BODY_LEN;
elems = ieee802_11_parse_elems(pos, ies_len,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 11d6c56c9d7e..1487b790f3e3 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -274,7 +274,7 @@ static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
if (!sdata)
return;
- BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
+ BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE(action_code));
if (skb->len < rtap_space + sizeof(action) +
VHT_MUMIMO_GROUPS_DATA_LEN)
@@ -1162,7 +1162,7 @@ static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
u8 category;
/* make sure category field is present */
- if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
+ if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE(category))
return RX_DROP_U_RUNT_ACTION;
mgmt = (struct ieee80211_mgmt *)hdr;
@@ -3422,7 +3422,7 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
return;
}
- if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
+ if (len < IEEE80211_MIN_ACTION_SIZE(sa_query)) {
/* Too short SA Query request frame */
return;
}
@@ -3432,17 +3432,16 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
return;
skb_reserve(skb, local->hw.extra_tx_headroom);
- resp = skb_put_zero(skb, 24);
+ resp = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE(sa_query));
memcpy(resp->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
memcpy(resp->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION);
- skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
- resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
- memcpy(resp->u.action.u.sa_query.trans_id,
- mgmt->u.action.u.sa_query.trans_id,
+ resp->u.action.action_code = WLAN_ACTION_SA_QUERY_RESPONSE;
+ memcpy(resp->u.action.sa_query.trans_id,
+ mgmt->u.action.sa_query.trans_id,
WLAN_SA_QUERY_TR_ID_LEN);
ieee80211_tx_skb(sdata, skb);
@@ -3516,7 +3515,7 @@ ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
/* drop too small action frames */
if (ieee80211_is_action(mgmt->frame_control) &&
- rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
+ rx->skb->len < IEEE80211_MIN_ACTION_SIZE(category))
return RX_DROP_U_RUNT_ACTION;
/* Drop non-broadcast Beacon frames */
@@ -3565,29 +3564,28 @@ ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
if (!rx->sta)
return false;
- switch (mgmt->u.action.u.s1g.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_S1G_TWT_SETUP: {
struct ieee80211_twt_setup *twt;
- if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
- 1 + /* action code */
+ if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE(action_code) +
sizeof(struct ieee80211_twt_setup) +
2 /* TWT req_type agrt */)
break;
- twt = (void *)mgmt->u.action.u.s1g.variable;
+ twt = (void *)mgmt->u.action.s1g.variable;
if (twt->element_id != WLAN_EID_S1G_TWT)
break;
- if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
- 4 + /* action code + token + tlv */
+ if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE(action_code) +
+ 3 + /* token + tlv */
twt->length)
break;
return true; /* queue the frame */
}
case WLAN_S1G_TWT_TEARDOWN:
- if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE + 2)
+ if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE(action_code) + 1)
break;
return true; /* queue the frame */
@@ -3632,10 +3630,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
break;
/* verify action & smps_control/chanwidth are present */
- if (len < IEEE80211_MIN_ACTION_SIZE + 2)
+ if (len < IEEE80211_MIN_ACTION_SIZE(ht_smps))
goto invalid;
- switch (mgmt->u.action.u.ht_smps.action) {
+ switch (mgmt->u.action.action_code) {
case WLAN_HT_ACTION_SMPS: {
struct ieee80211_supported_band *sband;
enum ieee80211_smps_mode smps_mode;
@@ -3646,7 +3644,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
goto handled;
/* convert to HT capability */
- switch (mgmt->u.action.u.ht_smps.smps_control) {
+ switch (mgmt->u.action.ht_smps.smps_control) {
case WLAN_HT_SMPS_CONTROL_DISABLED:
smps_mode = IEEE80211_SMPS_OFF;
break;
@@ -3679,7 +3677,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
goto handled;
}
case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
- u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
+ u8 chanwidth = mgmt->u.action.ht_notify_cw.chanwidth;
if (chanwidth != IEEE80211_HT_CHANWIDTH_20MHZ &&
chanwidth != IEEE80211_HT_CHANWIDTH_ANY)
@@ -3699,7 +3697,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
break;
case WLAN_CATEGORY_PUBLIC:
case WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION:
- if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+ if (len < IEEE80211_MIN_ACTION_SIZE(ext_chan_switch))
goto invalid;
if (sdata->vif.type != NL80211_IFTYPE_STATION)
break;
@@ -3707,12 +3705,9 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
break;
if (!ether_addr_equal(mgmt->bssid, sdata->deflink.u.mgd.bssid))
break;
- if (mgmt->u.action.u.ext_chan_switch.action_code !=
+ if (mgmt->u.action.action_code !=
WLAN_PUB_ACTION_EXT_CHANSW_ANN)
break;
- if (len < offsetof(struct ieee80211_mgmt,
- u.action.u.ext_chan_switch.variable))
- goto invalid;
goto queue;
case WLAN_CATEGORY_VHT:
if (sdata->vif.type != NL80211_IFTYPE_STATION &&
@@ -3723,18 +3718,18 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
break;
/* verify action code is present */
- if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+ if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
goto invalid;
- switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_VHT_ACTION_OPMODE_NOTIF: {
/* verify opmode is present */
- if (len < IEEE80211_MIN_ACTION_SIZE + 2)
+ if (len < IEEE80211_MIN_ACTION_SIZE(vht_opmode_notif))
goto invalid;
goto queue;
}
case WLAN_VHT_ACTION_GROUPID_MGMT: {
- if (len < IEEE80211_MIN_ACTION_SIZE + 25)
+ if (len < IEEE80211_MIN_ACTION_SIZE(vht_group_notif))
goto invalid;
goto queue;
}
@@ -3751,23 +3746,20 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
break;
/* verify action_code is present */
- if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+ if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
break;
- switch (mgmt->u.action.u.addba_req.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_ACTION_ADDBA_REQ:
- if (len < (IEEE80211_MIN_ACTION_SIZE +
- sizeof(mgmt->u.action.u.addba_req)))
+ if (len < IEEE80211_MIN_ACTION_SIZE(addba_req))
goto invalid;
break;
case WLAN_ACTION_ADDBA_RESP:
- if (len < (IEEE80211_MIN_ACTION_SIZE +
- sizeof(mgmt->u.action.u.addba_resp)))
+ if (len < IEEE80211_MIN_ACTION_SIZE(addba_resp))
goto invalid;
break;
case WLAN_ACTION_DELBA:
- if (len < (IEEE80211_MIN_ACTION_SIZE +
- sizeof(mgmt->u.action.u.delba)))
+ if (len < IEEE80211_MIN_ACTION_SIZE(delba))
goto invalid;
break;
default:
@@ -3777,16 +3769,15 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
goto queue;
case WLAN_CATEGORY_SPECTRUM_MGMT:
/* verify action_code is present */
- if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+ if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
break;
- switch (mgmt->u.action.u.measurement.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_ACTION_SPCT_MSR_REQ:
if (status->band != NL80211_BAND_5GHZ)
break;
- if (len < (IEEE80211_MIN_ACTION_SIZE +
- sizeof(mgmt->u.action.u.measurement)))
+ if (len < IEEE80211_MIN_ACTION_SIZE(measurement))
break;
if (sdata->vif.type != NL80211_IFTYPE_STATION)
@@ -3796,8 +3787,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
goto handled;
case WLAN_ACTION_SPCT_CHL_SWITCH: {
u8 *bssid;
- if (len < (IEEE80211_MIN_ACTION_SIZE +
- sizeof(mgmt->u.action.u.chan_switch)))
+ if (len < IEEE80211_MIN_ACTION_SIZE(chan_switch))
break;
if (sdata->vif.type != NL80211_IFTYPE_STATION &&
@@ -3822,11 +3812,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
}
break;
case WLAN_CATEGORY_SELF_PROTECTED:
- if (len < (IEEE80211_MIN_ACTION_SIZE +
- sizeof(mgmt->u.action.u.self_prot.action_code)))
+ if (len < IEEE80211_MIN_ACTION_SIZE(self_prot))
break;
- switch (mgmt->u.action.u.self_prot.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_SP_MESH_PEERING_OPEN:
case WLAN_SP_MESH_PEERING_CLOSE:
case WLAN_SP_MESH_PEERING_CONFIRM:
@@ -3844,8 +3833,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
}
break;
case WLAN_CATEGORY_MESH_ACTION:
- if (len < (IEEE80211_MIN_ACTION_SIZE +
- sizeof(mgmt->u.action.u.mesh_action.action_code)))
+ if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
break;
if (!ieee80211_vif_is_mesh(&sdata->vif))
@@ -3855,11 +3843,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
break;
goto queue;
case WLAN_CATEGORY_S1G:
- if (len < offsetofend(typeof(*mgmt),
- u.action.u.s1g.action_code))
+ if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
break;
- switch (mgmt->u.action.u.s1g.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_S1G_TWT_SETUP:
case WLAN_S1G_TWT_TEARDOWN:
if (ieee80211_process_rx_twt_action(rx))
@@ -3870,33 +3857,29 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
}
break;
case WLAN_CATEGORY_PROTECTED_EHT:
- if (len < offsetofend(typeof(*mgmt),
- u.action.u.ttlm_req.action_code))
+ if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
break;
- switch (mgmt->u.action.u.ttlm_req.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_PROTECTED_EHT_ACTION_TTLM_REQ:
if (sdata->vif.type != NL80211_IFTYPE_STATION)
break;
- if (len < offsetofend(typeof(*mgmt),
- u.action.u.ttlm_req))
+ if (len < IEEE80211_MIN_ACTION_SIZE(ttlm_req))
goto invalid;
goto queue;
case WLAN_PROTECTED_EHT_ACTION_TTLM_RES:
if (sdata->vif.type != NL80211_IFTYPE_STATION)
break;
- if (len < offsetofend(typeof(*mgmt),
- u.action.u.ttlm_res))
+ if (len < IEEE80211_MIN_ACTION_SIZE(ttlm_res))
goto invalid;
goto queue;
case WLAN_PROTECTED_EHT_ACTION_TTLM_TEARDOWN:
if (sdata->vif.type != NL80211_IFTYPE_STATION)
break;
- if (len < offsetofend(typeof(*mgmt),
- u.action.u.ttlm_tear_down))
+ if (len < IEEE80211_MIN_ACTION_SIZE(ttlm_tear_down))
goto invalid;
goto queue;
case WLAN_PROTECTED_EHT_ACTION_LINK_RECONFIG_RESP:
@@ -3906,34 +3889,29 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
/* The reconfiguration response action frame must
* least one 'Status Duple' entry (3 octets)
*/
- if (len <
- offsetofend(typeof(*mgmt),
- u.action.u.ml_reconf_resp) + 3)
+ if (len < IEEE80211_MIN_ACTION_SIZE(ml_reconf_resp) + 3)
goto invalid;
goto queue;
case WLAN_PROTECTED_EHT_ACTION_EPCS_ENABLE_RESP:
if (sdata->vif.type != NL80211_IFTYPE_STATION)
break;
- if (len < offsetofend(typeof(*mgmt),
- u.action.u.epcs) +
- IEEE80211_EPCS_ENA_RESP_BODY_LEN)
+ if (len < IEEE80211_MIN_ACTION_SIZE(epcs) +
+ IEEE80211_EPCS_ENA_RESP_BODY_LEN)
goto invalid;
goto queue;
case WLAN_PROTECTED_EHT_ACTION_EPCS_ENABLE_TEARDOWN:
if (sdata->vif.type != NL80211_IFTYPE_STATION)
break;
- if (len < offsetofend(typeof(*mgmt),
- u.action.u.epcs))
+ if (len < IEEE80211_MIN_ACTION_SIZE(epcs))
goto invalid;
goto queue;
case WLAN_PROTECTED_EHT_ACTION_EML_OP_MODE_NOTIF:
if (sdata->vif.type != NL80211_IFTYPE_AP)
break;
- if (len < offsetofend(typeof(*mgmt),
- u.action.u.eml_omn))
+ if (len < IEEE80211_MIN_ACTION_SIZE(eml_omn))
goto invalid;
goto queue;
default:
@@ -4015,11 +3993,10 @@ ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data *rx)
switch (mgmt->u.action.category) {
case WLAN_CATEGORY_SA_QUERY:
- if (len < (IEEE80211_MIN_ACTION_SIZE +
- sizeof(mgmt->u.action.u.sa_query)))
+ if (len < IEEE80211_MIN_ACTION_SIZE(sa_query))
break;
- switch (mgmt->u.action.u.sa_query.action) {
+ switch (mgmt->u.action.action_code) {
case WLAN_ACTION_SA_QUERY_REQUEST:
if (sdata->vif.type != NL80211_IFTYPE_STATION)
break;
diff --git a/net/mac80211/s1g.c b/net/mac80211/s1g.c
index 1f68df6e8067..297abaa6fecf 100644
--- a/net/mac80211/s1g.c
+++ b/net/mac80211/s1g.c
@@ -2,7 +2,7 @@
/*
* S1G handling
* Copyright(c) 2020 Adapt-IP
- * Copyright (C) 2023 Intel Corporation
+ * Copyright (C) 2023, 2026 Intel Corporation
*/
#include <linux/ieee80211.h>
#include <net/mac80211.h>
@@ -27,14 +27,14 @@ bool ieee80211_s1g_is_twt_setup(struct sk_buff *skb)
if (likely(mgmt->u.action.category != WLAN_CATEGORY_S1G))
return false;
- return mgmt->u.action.u.s1g.action_code == WLAN_S1G_TWT_SETUP;
+ return mgmt->u.action.action_code == WLAN_S1G_TWT_SETUP;
}
static void
ieee80211_s1g_send_twt_setup(struct ieee80211_sub_if_data *sdata, const u8 *da,
const u8 *bssid, struct ieee80211_twt_setup *twt)
{
- int len = IEEE80211_MIN_ACTION_SIZE + 4 + twt->length;
+ int len = IEEE80211_MIN_ACTION_SIZE(s1g) + 3 + twt->length;
struct ieee80211_local *local = sdata->local;
struct ieee80211_mgmt *mgmt;
struct sk_buff *skb;
@@ -52,8 +52,8 @@ ieee80211_s1g_send_twt_setup(struct ieee80211_sub_if_data *sdata, const u8 *da,
memcpy(mgmt->bssid, bssid, ETH_ALEN);
mgmt->u.action.category = WLAN_CATEGORY_S1G;
- mgmt->u.action.u.s1g.action_code = WLAN_S1G_TWT_SETUP;
- memcpy(mgmt->u.action.u.s1g.variable, twt, 3 + twt->length);
+ mgmt->u.action.action_code = WLAN_S1G_TWT_SETUP;
+ memcpy(mgmt->u.action.s1g.variable, twt, 3 + twt->length);
IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
IEEE80211_TX_INTFL_MLME_CONN_TX |
@@ -71,12 +71,12 @@ ieee80211_s1g_send_twt_teardown(struct ieee80211_sub_if_data *sdata,
u8 *id;
skb = dev_alloc_skb(local->hw.extra_tx_headroom +
- IEEE80211_MIN_ACTION_SIZE + 2);
+ IEEE80211_MIN_ACTION_SIZE(s1g) + 1);
if (!skb)
return;
skb_reserve(skb, local->hw.extra_tx_headroom);
- mgmt = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE + 2);
+ mgmt = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE(s1g) + 1);
mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION);
memcpy(mgmt->da, da, ETH_ALEN);
@@ -84,8 +84,8 @@ ieee80211_s1g_send_twt_teardown(struct ieee80211_sub_if_data *sdata,
memcpy(mgmt->bssid, bssid, ETH_ALEN);
mgmt->u.action.category = WLAN_CATEGORY_S1G;
- mgmt->u.action.u.s1g.action_code = WLAN_S1G_TWT_TEARDOWN;
- id = (u8 *)mgmt->u.action.u.s1g.variable;
+ mgmt->u.action.action_code = WLAN_S1G_TWT_TEARDOWN;
+ id = (u8 *)mgmt->u.action.s1g.variable;
*id = flowid;
IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
@@ -98,7 +98,7 @@ ieee80211_s1g_rx_twt_setup(struct ieee80211_sub_if_data *sdata,
struct sta_info *sta, struct sk_buff *skb)
{
struct ieee80211_mgmt *mgmt = (void *)skb->data;
- struct ieee80211_twt_setup *twt = (void *)mgmt->u.action.u.s1g.variable;
+ struct ieee80211_twt_setup *twt = (void *)mgmt->u.action.s1g.variable;
struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
twt_agrt->req_type &= cpu_to_le16(~IEEE80211_TWT_REQTYPE_REQUEST);
@@ -128,7 +128,7 @@ ieee80211_s1g_rx_twt_teardown(struct ieee80211_sub_if_data *sdata,
struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
drv_twt_teardown_request(sdata->local, sdata, &sta->sta,
- mgmt->u.action.u.s1g.variable[0]);
+ mgmt->u.action.s1g.variable[0]);
}
static void
@@ -136,7 +136,7 @@ ieee80211_s1g_tx_twt_setup_fail(struct ieee80211_sub_if_data *sdata,
struct sta_info *sta, struct sk_buff *skb)
{
struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
- struct ieee80211_twt_setup *twt = (void *)mgmt->u.action.u.s1g.variable;
+ struct ieee80211_twt_setup *twt = (void *)mgmt->u.action.s1g.variable;
struct ieee80211_twt_params *twt_agrt = (void *)twt->params;
u8 flowid = le16_get_bits(twt_agrt->req_type,
IEEE80211_TWT_REQTYPE_FLOWID);
@@ -160,7 +160,7 @@ void ieee80211_s1g_rx_twt_action(struct ieee80211_sub_if_data *sdata,
if (!sta)
return;
- switch (mgmt->u.action.u.s1g.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_S1G_TWT_SETUP:
ieee80211_s1g_rx_twt_setup(sdata, sta, skb);
break;
@@ -185,7 +185,7 @@ void ieee80211_s1g_status_twt_action(struct ieee80211_sub_if_data *sdata,
if (!sta)
return;
- switch (mgmt->u.action.u.s1g.action_code) {
+ switch (mgmt->u.action.action_code) {
case WLAN_S1G_TWT_SETUP:
/* process failed twt setup frames */
ieee80211_s1g_tx_twt_setup_fail(sdata, sta, skb);
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index 7422888d3640..e2eaf8d8d7ff 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -9,7 +9,7 @@
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
* Copyright 2007-2008, Intel Corporation
* Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
- * Copyright (C) 2018, 2020, 2022-2024 Intel Corporation
+ * Copyright (C) 2018, 2020, 2022-2024, 2026 Intel Corporation
*/
#include <linux/ieee80211.h>
@@ -409,35 +409,30 @@ static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_da
struct sk_buff *skb;
struct ieee80211_mgmt *msr_report;
- skb = dev_alloc_skb(sizeof(*msr_report) + local->hw.extra_tx_headroom +
- sizeof(struct ieee80211_msrment_ie));
+ skb = dev_alloc_skb(IEEE80211_MIN_ACTION_SIZE(measurement) +
+ local->hw.extra_tx_headroom);
if (!skb)
return;
skb_reserve(skb, local->hw.extra_tx_headroom);
- msr_report = skb_put_zero(skb, 24);
+ msr_report = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE(measurement));
memcpy(msr_report->da, da, ETH_ALEN);
memcpy(msr_report->sa, sdata->vif.addr, ETH_ALEN);
memcpy(msr_report->bssid, bssid, ETH_ALEN);
msr_report->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION);
- skb_put(skb, 1 + sizeof(msr_report->u.action.u.measurement));
msr_report->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
- msr_report->u.action.u.measurement.action_code =
- WLAN_ACTION_SPCT_MSR_RPRT;
- msr_report->u.action.u.measurement.dialog_token = dialog_token;
+ msr_report->u.action.action_code = WLAN_ACTION_SPCT_MSR_RPRT;
- msr_report->u.action.u.measurement.element_id = WLAN_EID_MEASURE_REPORT;
- msr_report->u.action.u.measurement.length =
+ msr_report->u.action.measurement.dialog_token = dialog_token;
+ msr_report->u.action.measurement.element_id = WLAN_EID_MEASURE_REPORT;
+ msr_report->u.action.measurement.length =
sizeof(struct ieee80211_msrment_ie);
-
- memset(&msr_report->u.action.u.measurement.msr_elem, 0,
- sizeof(struct ieee80211_msrment_ie));
- msr_report->u.action.u.measurement.msr_elem.token = request_ie->token;
- msr_report->u.action.u.measurement.msr_elem.mode |=
+ msr_report->u.action.measurement.msr_elem.token = request_ie->token;
+ msr_report->u.action.measurement.msr_elem.mode |=
IEEE80211_SPCT_MSR_RPRT_MODE_REFUSED;
- msr_report->u.action.u.measurement.msr_elem.type = request_ie->type;
+ msr_report->u.action.measurement.msr_elem.type = request_ie->type;
ieee80211_tx_skb(sdata, skb);
}
@@ -454,7 +449,7 @@ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
* TODO: Answer basic measurement as unmeasured
*/
ieee80211_send_refuse_measurement_request(sdata,
- &mgmt->u.action.u.measurement.msr_elem,
+ &mgmt->u.action.measurement.msr_elem,
mgmt->sa, mgmt->bssid,
- mgmt->u.action.u.measurement.dialog_token);
+ mgmt->u.action.measurement.dialog_token);
}
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index dbbfe2d6842f..1f30a4eda374 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -6,7 +6,7 @@
* Copyright 2014, Intel Corporation
* Copyright 2014 Intel Mobile Communications GmbH
* Copyright 2015 - 2016 Intel Deutschland GmbH
- * Copyright (C) 2019, 2021-2025 Intel Corporation
+ * Copyright (C) 2019, 2021-2026 Intel Corporation
*/
#include <linux/ieee80211.h>
@@ -879,28 +879,23 @@ ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
struct ieee80211_mgmt *mgmt;
- mgmt = skb_put_zero(skb, 24);
+ if (action_code != WLAN_PUB_ACTION_TDLS_DISCOVER_RES)
+ return -EINVAL;
+
+ mgmt = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE(tdls_discover_resp));
memcpy(mgmt->da, peer, ETH_ALEN);
memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
memcpy(mgmt->bssid, link->u.mgd.bssid, ETH_ALEN);
mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
IEEE80211_STYPE_ACTION);
- switch (action_code) {
- case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
- skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp));
- mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
- mgmt->u.action.u.tdls_discover_resp.action_code =
- WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
- mgmt->u.action.u.tdls_discover_resp.dialog_token =
- dialog_token;
- mgmt->u.action.u.tdls_discover_resp.capability =
- cpu_to_le16(ieee80211_get_tdls_sta_capab(link,
- status_code));
- break;
- default:
- return -EINVAL;
- }
+ mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
+ mgmt->u.action.action_code = WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
+
+ mgmt->u.action.tdls_discover_resp.dialog_token = dialog_token;
+ mgmt->u.action.tdls_discover_resp.capability =
+ cpu_to_le16(ieee80211_get_tdls_sta_capab(link,
+ status_code));
return 0;
}
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index a5e09c0fa6b3..f44d9cb35b0e 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -3768,12 +3768,11 @@ void ieee80211_chandef_downgrade(struct cfg80211_chan_def *c,
int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
struct cfg80211_csa_settings *csa_settings)
{
+ int hdr_len = IEEE80211_MIN_ACTION_SIZE(chan_switch);
struct sk_buff *skb;
struct ieee80211_mgmt *mgmt;
struct ieee80211_local *local = sdata->local;
int freq;
- int hdr_len = offsetofend(struct ieee80211_mgmt,
- u.action.u.chan_switch);
u8 *pos;
if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
@@ -3802,7 +3801,7 @@ int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
}
mgmt->u.action.category = WLAN_CATEGORY_SPECTRUM_MGMT;
- mgmt->u.action.u.chan_switch.action_code = WLAN_ACTION_SPCT_CHL_SWITCH;
+ mgmt->u.action.action_code = WLAN_ACTION_SPCT_CHL_SWITCH;
pos = skb_put(skb, 5);
*pos++ = WLAN_EID_CHANNEL_SWITCH; /* EID */
*pos++ = 3; /* IE length */
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index b099d79e8fbb..80120f9f17b6 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -4,7 +4,7 @@
*
* Portions of this file
* Copyright(c) 2015 - 2016 Intel Deutschland GmbH
- * Copyright (C) 2018 - 2024 Intel Corporation
+ * Copyright (C) 2018-2026 Intel Corporation
*/
#include <linux/ieee80211.h>
@@ -723,17 +723,17 @@ void ieee80211_process_mu_groups(struct ieee80211_sub_if_data *sdata,
if (!link_conf->mu_mimo_owner)
return;
- if (!memcmp(mgmt->u.action.u.vht_group_notif.position,
+ if (!memcmp(mgmt->u.action.vht_group_notif.position,
link_conf->mu_group.position, WLAN_USER_POSITION_LEN) &&
- !memcmp(mgmt->u.action.u.vht_group_notif.membership,
+ !memcmp(mgmt->u.action.vht_group_notif.membership,
link_conf->mu_group.membership, WLAN_MEMBERSHIP_LEN))
return;
memcpy(link_conf->mu_group.membership,
- mgmt->u.action.u.vht_group_notif.membership,
+ mgmt->u.action.vht_group_notif.membership,
WLAN_MEMBERSHIP_LEN);
memcpy(link_conf->mu_group.position,
- mgmt->u.action.u.vht_group_notif.position,
+ mgmt->u.action.vht_group_notif.position,
WLAN_USER_POSITION_LEN);
ieee80211_link_info_change_notify(sdata, link,
--
2.53.0
^ permalink raw reply related
* Re: [PATCH ath-next 0/2] wifi: ath12k: fixes to station statistics request
From: Vasanthakumar Thiagarajan @ 2026-02-25 17:01 UTC (permalink / raw)
To: Baochen Qiang, Jeff Johnson; +Cc: linux-wireless, ath12k
In-Reply-To: <20260129-ath12k-fw-stats-fixes-v1-0-55d66064f4d5@oss.qualcomm.com>
On 1/29/2026 7:54 AM, Baochen Qiang wrote:
> ath12k hits timeout and memory leak when requesting firmware statistics,
> fix them.
>
> Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
> ---
> Baochen Qiang (2):
> wifi: ath12k: use correct pdev id when requesting firmware stats
> wifi: ath12k: fix station lookup failure when disconnecting from AP
>
> drivers/net/wireless/ath/ath12k/mac.c | 6 +++---
> drivers/net/wireless/ath/ath12k/wmi.c | 36 +++++++++++++----------------------
> 2 files changed, 16 insertions(+), 26 deletions(-)
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
^ permalink raw reply
* Re: [PATCH] wifi: move action code from per-type frame structs
From: Johannes Berg @ 2026-02-25 17:08 UTC (permalink / raw)
To: linux-wireless
In-Reply-To: <20260225175252.03c5c338a7b2.I9a24328e3ffcaae179466a935f1c3345029f9961@changeid>
Hi all,
Couple of things I noticed while doing this, for driver maintainers:
> --- a/drivers/net/wireless/marvell/mwl8k.c
> +++ b/drivers/net/wireless/marvell/mwl8k.c
> @@ -1985,9 +1985,9 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw,
> */
> if (unlikely(ieee80211_is_action(wh->frame_control) &&
> mgmt->u.action.category == WLAN_CATEGORY_BACK &&
> - mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ &&
> + mgmt->u.action.action_code == WLAN_ACTION_ADDBA_REQ &&
> priv->ap_fw)) {
> - u16 capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
> + u16 capab = le16_to_cpu(mgmt->u.action.addba_req.capab);
> tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
> index = mwl8k_tid_queue_mapping(tid);
I'm not convinced this isn't broken because there's no length check for
the frame, and monitor mode injection could happen?
> --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
> +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
> @@ -414,8 +414,8 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
>
> if (ieee80211_is_action(fc) &&
> mgmt->u.action.category == WLAN_CATEGORY_BACK &&
> - mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {
> - u16 capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
> + mgmt->u.action.action_code == WLAN_ACTION_ADDBA_REQ) {
> + u16 capab = le16_to_cpu(mgmt->u.action.addba_req.capab);
Same here and in the other mt76 drivers, but
> txwi[5] |= cpu_to_le32(MT_TXD5_ADD_BA);
> tid = (capab >> 2) & IEEE80211_QOS_CTL_TID_MASK;
maybe this kind of thing shouldn't happen for injected frames anyway
(there's a flag you can check)
> +++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c
> @@ -5146,10 +5146,10 @@ static void rtl8xxxu_dump_action(struct device *dev,
> if (!(rtl8xxxu_debug & RTL8XXXU_DEBUG_ACTION))
> return;
>
> - switch (mgmt->u.action.u.addba_resp.action_code) {
> + switch (mgmt->u.action.action_code) {
This seems broken the same way.
> +++ b/drivers/net/wireless/realtek/rtlwifi/base.c
> @@ -1409,7 +1409,7 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
> sta_entry =
> (struct rtl_sta_info *)sta->drv_priv;
> capab =
> - le16_to_cpu(mgmt->u.action.u.addba_req.capab);
> + le16_to_cpu(mgmt->u.action.addba_req.capab);
> tid = (capab &
> IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
> if (tid >= MAX_TID_COUNT) {
This one is worse because it's not even just local, it's over-the-air
(invoked on RX frames)
> @@ -2519,25 +2519,25 @@ struct sk_buff *rtl_make_del_ba(struct ieee80211_hw *hw,
> struct ieee80211_mgmt *action_frame;
> u16 params;
>
> - /* 27 = header + category + action + smps mode */
> - skb = dev_alloc_skb(34 + hw->extra_tx_headroom);
> + skb = dev_alloc_skb(IEEE80211_MIN_ACTION_SIZE(delba) +
> + hw->extra_tx_headroom);
This one's weird ... it got the comment copy/pasted from SMPS, so that's
completely wrong anyway, but if I'm counting correctly then
IEEE80211_MIN_ACTION_SIZE(delba) is actually 30 not 34, so was it
sending frames that are too long?
> if (!skb)
> return NULL;
>
> skb_reserve(skb, hw->extra_tx_headroom);
> - action_frame = skb_put_zero(skb, 34);
> + action_frame = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE(delba));
> memcpy(action_frame->sa, sa, ETH_ALEN);
> memcpy(action_frame->da, rtlefuse->dev_addr, ETH_ALEN);
> memcpy(action_frame->bssid, bssid, ETH_ALEN);
> action_frame->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
> IEEE80211_STYPE_ACTION);
> action_frame->u.action.category = WLAN_CATEGORY_BACK;
> - action_frame->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
> + action_frame->u.action.action_code = WLAN_ACTION_DELBA;
> params = (u16)(1 << 11); /* bit 11 initiator */
> params |= (u16)(tid << 12); /* bit 15:12 TID number */
>
> - action_frame->u.action.u.delba.params = cpu_to_le16(params);
> - action_frame->u.action.u.delba.reason_code =
> + action_frame->u.action.delba.params = cpu_to_le16(params);
> + action_frame->u.action.delba.reason_code =
> cpu_to_le16(WLAN_REASON_QSTA_TIMEOUT);
It's not putting anything beyond the normal DelBA frame ...
> +++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
> @@ -507,7 +507,7 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
> if (ieee80211_is_action(fc)) {
> struct ieee80211_mgmt *action_frame =
> (struct ieee80211_mgmt *)skb->data;
> - if (action_frame->u.action.u.ht_smps.action ==
> + if (action_frame->u.action.action_code ==
> WLAN_HT_ACTION_SMPS) {
Same issue with frame length I think.
johannes
^ permalink raw reply
* Re: [PATCH v3] wifi: ath11k: fix memory leaks in beacon template setup
From: Vasanthakumar Thiagarajan @ 2026-02-25 17:08 UTC (permalink / raw)
To: Zilin Guan, jeff.johnson
Cc: ath11k, baochen.qiang, jianhao.xu, jjohnson, linux-kernel,
linux-wireless
In-Reply-To: <20260130084451.110768-1-zilin@seu.edu.cn>
On 1/30/2026 2:14 PM, Zilin Guan wrote:
> The functions ath11k_mac_setup_bcn_tmpl_ema() and
> ath11k_mac_setup_bcn_tmpl_mbssid() allocate memory for beacon templates
> but fail to free it when parameter setup returns an error.
>
> Since beacon templates must be released during normal execution, they
> must also be released in the error handling paths to prevent memory
> leaks.
>
> Fix this by using unified exit paths with proper cleanup in the respective
> error paths.
>
> Compile tested only. Issue found using a prototype static analysis tool
> and code review.
>
> Fixes: 3a415daa3e8b ("wifi: ath11k: add P2P IE in beacon template")
> Fixes: 335a92765d30 ("wifi: ath11k: MBSSID beacon support")
> Suggested-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
> Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox