[GIT PULL] wireless-2026-07-09

[Johannes Berg <johannes@sipsolutions.net>]

Hi,

Sorry, I meant to send this yesterday, hoping it'd get
in/out before netdevconf and all that, because it's
actually really big. Mostly I've now collected many
random LLM-induced robustness fixes (I can't really
call most of them security fixes, though there likely
are a few).

Please pull and let us know if there's any problem.

Thanks,
johannes



The following changes since commit 87320be9f0d24fce67631b7eef919f0b79c3e45c:

  Merge tag 'net-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-07-02 06:01:12 -1000)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git tags/wireless-2026-07-09

for you to fetch changes up to cb8afea4655ff004fa7feee825d5c79783525383:

  wifi: cfg80211: bound element ID read when checking non-inheritance (2026-07-07 14:00:35 +0200)

----------------------------------------------------------------
Too many robustness fixes to list. Mostly for
 - slight out-of-bounds reads of SKBs,
 - leaks on error conditions, and
 - malformed netlink input rejection.

----------------------------------------------------------------
Abdun Nihaal (1):
      wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()

Arnd Bergmann (1):
      wifi: mac80211: allocate backup ieee80211_nan_sched_cfg off stack

Bryam Vargas (1):
      wifi: mac80211_hwsim: clamp virtio RX length before skb_put

Cen Zhang (3):
      wifi: cfg80211: cancel sched scan results work on unregister
      wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
      wifi: cfg80211: use wiphy work for socket owner autodisconnect

Christophe JAILLET (1):
      wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()

Corentin Labbe (1):
      wifi: ralink: RT2X00: init EEPROM properly

Dawei Feng (2):
      wifi: libertas: fix memory leak in helper_firmware_cb()
      wifi: mac80211: fix memory leak in ieee80211_register_hw()

HE WEI (ギカク) (1):
      wifi: cfg80211: bound element ID read when checking non-inheritance

Haofeng Li (1):
      wifi: cfg80211: validate EHT MLE before MLD ID read

Maoyi Xie (3):
      wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
      wifi: mac80211: defer link RX stats percpu free to RCU
      wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

Pagadala Yesu Anjaneyulu (1):
      wifi: mac80211: ibss: wait for in-flight TX on disconnect

Peddolla Harshavardhan Reddy (1):
      wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock

Pengpeng Hou (5):
      wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
      wifi: libertas: reject short monitor TX frames
      wifi: rsi: bound background scan probe request copy
      wifi: libipw: fix key index receive bound checks
      wifi: rsi: validate beacon length before fixed buffer copy

Rafael Beims (2):
      wifi: mwifiex: fix roaming to different channel in host_mlme mode
      wifi: mwifiex: fix permanently busy scans after multiple roam iterations

Runyu Xiao (2):
      wifi: rt2x00: avoid full teardown before work setup in probe
      wifi: brcmfmac: initialize SDIO data work before cleanup

Shahar Tzarfati (1):
      wifi: mac80211: recalculate rx_nss on IBSS peer capability update

Xiang Mei (3):
      wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
      wifi: mac80211: fix fils_discovery double free on alloc failure
      wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

Yousef Alhouseen (1):
      wifi: mac80211_hwsim: avoid treating MCS as legacy rate index

Zhao Li (14):
      wifi: nl80211: free RNR data on MBSSID mismatch
      wifi: mac80211: validate extension-frame layout before RX
      wifi: cfg80211: derive S1G beacon TSF from S1G fields
      wifi: ieee80211: validate MLE common info length
      wifi: nl80211: validate nested MBSSID IE blobs
      wifi: nl80211: constrain MBSSID TX link ID range
      wifi: cfg80211: validate PMSR measurement type data
      wifi: cfg80211: validate PMSR FTM preamble range
      wifi: cfg80211: reject unsupported PMSR FTM location requests
      wifi: cfg80211: reject empty PMSR peer lists
      wifi: mac80211: avoid non-S1G AID fallback for S1G assoc
      wifi: mac80211: validate deauth frame length before reason access
      wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
      wifi: cfg80211: validate assoc response length before status and IE access

Zhiling Zou (1):
      wifi: mac80211: free ack status frame on TX header build failure

 .../broadcom/brcm80211/brcmfmac/cyw/core.c         |   6 ++
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |   2 +-
 drivers/net/wireless/intel/ipw2x00/ipw2100.c       |   8 +-
 drivers/net/wireless/intel/ipw2x00/libipw_rx.c     |   4 +-
 drivers/net/wireless/intersil/p54/txrx.c           |   8 ++
 drivers/net/wireless/marvell/libertas/firmware.c   |   1 +
 drivers/net/wireless/marvell/libertas/tx.c         |   7 ++
 drivers/net/wireless/marvell/libertas_tf/main.c    |   2 +-
 drivers/net/wireless/marvell/mwifiex/cfg80211.c    |   2 +-
 drivers/net/wireless/marvell/mwifiex/join.c        |   1 -
 drivers/net/wireless/ralink/rt2x00/rt2400pci.c     |   2 +-
 drivers/net/wireless/ralink/rt2x00/rt2500pci.c     |   2 +-
 drivers/net/wireless/ralink/rt2x00/rt2800pci.c     |   2 +-
 drivers/net/wireless/ralink/rt2x00/rt2x00dev.c     |  12 ++-
 drivers/net/wireless/ralink/rt2x00/rt61pci.c       |   2 +-
 drivers/net/wireless/rsi/rsi_91x_hal.c             |   8 ++
 drivers/net/wireless/rsi/rsi_91x_mgmt.c            |  12 ++-
 drivers/net/wireless/virtual/mac80211_hwsim_main.c |  16 +++-
 include/linux/ieee80211-eht.h                      |  12 +--
 include/net/cfg80211.h                             |   4 +-
 net/mac80211/cfg.c                                 |  11 ++-
 net/mac80211/ibss.c                                |  13 +--
 net/mac80211/iface.c                               |   8 +-
 net/mac80211/main.c                                |   3 +-
 net/mac80211/mlme.c                                |  12 ++-
 net/mac80211/nan.c                                 |  35 +++----
 net/mac80211/rx.c                                  |  34 ++++++-
 net/mac80211/sta_info.c                            |  15 ++-
 net/mac80211/tx.c                                  |  17 +++-
 net/mac80211/util.c                                |   3 +
 net/wireless/core.c                                |  14 +--
 net/wireless/core.h                                |   4 +-
 net/wireless/mlme.c                                | 105 +++++++++++++++------
 net/wireless/nl80211.c                             |  25 +++--
 net/wireless/pmsr.c                                |  34 +++++--
 net/wireless/scan.c                                |  18 ++--
 net/wireless/sme.c                                 |   6 +-
 37 files changed, 336 insertions(+), 134 deletions(-)