[GIT PULL] wireless-2026-09-30

[GIT PULL] wireless-2026-09-30

[Johannes Berg]

Hi,

Things aren't really slowing down by that much, unfortunately, but
these are mostly fairlyh obvious changes.

Note there will be a merge conflict with ieee80211_lookup_ra_sta()
when this gets pulled into net-next which made it static, and here
we add another argument to the function.

Please pull and let us know if there's any problem.

Thanks,
johannes



The following changes since commit b5a051f6b840d48f159166ef073d3021989bfb50:

  Merge tag 'net-7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-09-17 10:40:48 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git tags/wireless-2026-09-30

for you to fetch changes up to 6f63e919fe1e335b8abcb3a28bfd4804a98d875a:

  wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() (2026-09-28 11:11:19 +0200)

----------------------------------------------------------------
Still more fixes coming in, notably:
 - ath11k: avoid running out of stations on HW restart
 - mac80211:
   - drop too large fragmented MPDUs
   - mesh path handling fixes
   - validation improvements
   - reject CSA with bad 320 MHz bandwidth
 - cfg80211: fix RTS for single radio devices

----------------------------------------------------------------
Aamir Ahmed (1):
      wifi: wfx: validate MIB read length before copying to caller

Cen Zhang (Microsoft) (1):
      wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()

Felix Fietkau (2):
      wifi: mac80211: prevent AP VLAN tx from other interfaces
      wifi: mac80211: set info->band for 802.3 encap offload frames

Georgios Karantzas (1):
      wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE

Guangshuo Li (1):
      wifi: iwlegacy: 3945: free EEPROM data on remove

Heyang Tan (1):
      wifi: p54: validate firmware record lengths

Johannes Berg (1):
      Merge tag 'ath-current-20260921' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath

Nicolas Escande (1):
      wifi: ath11k: reset ar->num_stations on hardware start

Pengpeng Hou (1):
      wifi: ath9k: reject short WMI command responses

Ruide Cao (1):
      wifi: mac80211: reject invalid 320 MHz CSA bandwidth

Stanislaw Gruszka (1):
      wifi: cfg80211: fix RTS threshold setting for single-radio PHY

Tianchu Chen (1):
      wifi: cw1200: fix TX padding OOB read leaking heap data to device

Toke Høiland-Jørgensen (1):
      wifi: ath9k: Clean up device initialisation guards

Wentao Liang (1):
      wifi: wlcore: Fix runtime PM leak in wlcore_remove()

Yuchao Zhang (1):
      wifi: mac80211: drop oversized fragments to avoid extra_len overflow

Yuqi Xu (3):
      wifi: mac80211: minstrel_ht: validate fixed rate index
      wifi: mac80211: handle empty FILS association request payload
      wifi: mac80211: validate TX status rate metadata

Zhao Li (6):
      wifi: mac80211: release mesh path quota on failed additions
      wifi: mac80211: account proxy paths against the mesh path limit
      wifi: mac80211: drain PS delivery work during station teardown
      wifi: mac80211: shut down RX BA session timer on teardown
      wifi: mac80211: keep fallback association elements alive
      wifi: cfg80211: preserve hidden-group beacon IE ownership

Zhiling Zou (2):
      wifi: mac80211: count only matching reservations in reserved switch
      wifi: mac80211: keep paired old chanctx alive

Zihan Xi (1):
      wifi: mac80211: fix mesh fast xmit path deletion UAF

 drivers/net/wireless/ath/ath11k/mac.c          |  1 +
 drivers/net/wireless/ath/ath9k/hif_usb.c       | 21 +++---
 drivers/net/wireless/ath/ath9k/htc.h           |  1 -
 drivers/net/wireless/ath/ath9k/htc_drv_init.c  |  7 +-
 drivers/net/wireless/ath/ath9k/htc_drv_txrx.c  |  8 +--
 drivers/net/wireless/ath/ath9k/wmi.c           | 28 +++++---
 drivers/net/wireless/ath/ath9k/wmi.h           |  1 +
 drivers/net/wireless/intel/iwlegacy/3945-mac.c |  1 +
 drivers/net/wireless/intersil/p54/fwio.c       | 42 ++++++++++--
 drivers/net/wireless/silabs/wfx/hif_tx.c       |  4 +-
 drivers/net/wireless/st/cw1200/bh.c            |  8 ++-
 drivers/net/wireless/st/cw1200/txrx.c          | 14 ++++
 drivers/net/wireless/ti/wlcore/main.c          |  4 +-
 net/mac80211/agg-rx.c                          |  2 +-
 net/mac80211/chan.c                            | 50 ++++++++++++---
 net/mac80211/drop.h                            |  1 +
 net/mac80211/fils_aead.c                       |  8 +++
 net/mac80211/ieee80211_i.h                     |  2 +-
 net/mac80211/iface.c                           |  4 +-
 net/mac80211/mesh_pathtbl.c                    | 30 +++++++--
 net/mac80211/mlme.c                            |  4 +-
 net/mac80211/rc80211_minstrel_ht.c             | 89 +++++++++++++++++++++++---
 net/mac80211/rx.c                              |  6 ++
 net/mac80211/spectmgmt.c                       |  4 +-
 net/mac80211/sta_info.c                        |  6 +-
 net/mac80211/status.c                          | 70 ++++++++++++++++++++
 net/mac80211/tx.c                              | 45 +++++++++----
 net/wireless/nl80211.c                         | 11 ++--
 net/wireless/scan.c                            | 22 ++++---
 29 files changed, 395 insertions(+), 99 deletions(-)

Re: [GIT PULL] wireless-2026-09-30

[Jakub Kicinski]

On Wed, 30 Sep 2026 14:43:00 +0200 Johannes Berg wrote:
> Things aren't really slowing down by that much, unfortunately, but
> these are mostly fairlyh obvious changes.

FWIW Linus started pushing back on the PR sizes last week.
So we gotta be more judicious going forward. I think you were already
more judicious than us in general, but keep that we got warned in mind.

I spotted some probe/remove fixes here (wlcore, iwlegacy etc), I tend
to queue anything like that to -next these days, those are infinite.
Potentially also the Tx status reporting ? (AFAIU that'd imply a
malicious device.)

All of that only if you have spare mental capacity.
Otherwise just ignore and keep doing what you're doing.

Re: [GIT PULL] wireless-2026-09-30

[patchwork-bot+netdevbpf]

Hello:

This pull request was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 30 Sep 2026 14:43:00 +0200 you wrote:
> Hi,
> 
> Things aren't really slowing down by that much, unfortunately, but
> these are mostly fairlyh obvious changes.
> 
> Note there will be a merge conflict with ieee80211_lookup_ra_sta()
> when this gets pulled into net-next which made it static, and here
> we add another argument to the function.
> 
> [...]

Here is the summary with links:
  - [GIT,PULL] wireless-2026-09-30
    https://git.kernel.org/netdev/net/c/be35a3e00394

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html