Skip to content

Commit a83155c

Browse files
kuba-mookuba-moo
committed
Johannes Berg says: ==================== First set of fixes: - brcmfmac: long-standing crash when used w/o P2P - iwlwifi: fix for a use-after-free bug - mac80211: key tailroom accounting bug could leave allocation overhead and cause a warning - ath11k: add a missing platform, fix key flag operations - bcma: skip devices disabled in OF/DT - various (potential) memory leaks * tag 'wireless-2025-10-23' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: nl80211: call kfree without a NULL check wifi: mac80211: fix key tailroom accounting leak wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode MAINTAINERS: wcn36xx: Add linux-wireless list bcma: don't register devices disabled in OF wifi: mac80211: reset FILS discovery and unsol probe resp intervals wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link() wifi: ath11k: avoid bit operation on key flags wifi: ath12k: free skb during idr cleanup callback wifi: ath11k: Add missing platform IDs for quirk table wifi: ath10k: Fix memory leak on unsupported WMI command ==================== Link: https://patch.msgid.link/20251023180604.626946-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 parents ab431bc + 69e4b75 commit a83155c

13 files changed

Lines changed: 106 additions & 56 deletions

File tree

‎MAINTAINERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21318,6 +21318,7 @@ F: drivers/media/platform/qcom/venus/
2131821318
QUALCOMM WCN36XX WIRELESS DRIVER
2131921319
M: Loic Poulain <loic.poulain@oss.qualcomm.com>
2132021320
L: wcn36xx@lists.infradead.org
21321+
L: linux-wireless@vger.kernel.org
2132121322
S: Supported
2132221323
W: https://wireless.wiki.kernel.org/en/users/Drivers/wcn36xx
2132321324
F: drivers/net/wireless/ath/wcn36xx/

‎drivers/bcma/main.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,8 @@ static int bcma_register_devices(struct bcma_bus *bus)
294294
int err;
295295

296296
list_for_each_entry(core, &bus->cores, list) {
297+
struct device_node *np;
298+
297299
/* We support that core ourselves */
298300
switch (core->id.id) {
299301
case BCMA_CORE_4706_CHIPCOMMON:
@@ -311,6 +313,10 @@ static int bcma_register_devices(struct bcma_bus *bus)
311313
if (bcma_is_core_needed_early(core->id.id))
312314
continue;
313315

316+
np = core->dev.of_node;
317+
if (np && !of_device_is_available(np))
318+
continue;
319+
314320
/* Only first GMAC core on BCM4706 is connected and working */
315321
if (core->id.id == BCMA_CORE_4706_MAC_GBIT &&
316322
core->core_unit > 0)

‎drivers/net/wireless/ath/ath10k/wmi.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1937,6 +1937,7 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)
19371937
if (cmd_id == WMI_CMD_UNSUPPORTED) {
19381938
ath10k_warn(ar, "wmi command %d is not supported by firmware\n",
19391939
cmd_id);
1940+
dev_kfree_skb_any(skb);
19401941
return ret;
19411942
}
19421943

‎drivers/net/wireless/ath/ath11k/core.c‎

Lines changed: 48 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -912,42 +912,84 @@ static const struct ath11k_hw_params ath11k_hw_params[] = {
912912
static const struct dmi_system_id ath11k_pm_quirk_table[] = {
913913
{
914914
.driver_data = (void *)ATH11K_PM_WOW,
915-
.matches = {
915+
.matches = { /* X13 G4 AMD #1 */
916+
DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
917+
DMI_MATCH(DMI_PRODUCT_NAME, "21J3"),
918+
},
919+
},
920+
{
921+
.driver_data = (void *)ATH11K_PM_WOW,
922+
.matches = { /* X13 G4 AMD #2 */
916923
DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
917924
DMI_MATCH(DMI_PRODUCT_NAME, "21J4"),
918925
},
919926
},
920927
{
921928
.driver_data = (void *)ATH11K_PM_WOW,
922-
.matches = {
929+
.matches = { /* T14 G4 AMD #1 */
930+
DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
931+
DMI_MATCH(DMI_PRODUCT_NAME, "21K3"),
932+
},
933+
},
934+
{
935+
.driver_data = (void *)ATH11K_PM_WOW,
936+
.matches = { /* T14 G4 AMD #2 */
923937
DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
924938
DMI_MATCH(DMI_PRODUCT_NAME, "21K4"),
925939
},
926940
},
927941
{
928942
.driver_data = (void *)ATH11K_PM_WOW,
929-
.matches = {
943+
.matches = { /* P14s G4 AMD #1 */
944+
DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
945+
DMI_MATCH(DMI_PRODUCT_NAME, "21K5"),
946+
},
947+
},
948+
{
949+
.driver_data = (void *)ATH11K_PM_WOW,
950+
.matches = { /* P14s G4 AMD #2 */
930951
DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
931952
DMI_MATCH(DMI_PRODUCT_NAME, "21K6"),
932953
},
933954
},
934955
{
935956
.driver_data = (void *)ATH11K_PM_WOW,
936-
.matches = {
957+
.matches = { /* T16 G2 AMD #1 */
958+
DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
959+
DMI_MATCH(DMI_PRODUCT_NAME, "21K7"),
960+
},
961+
},
962+
{
963+
.driver_data = (void *)ATH11K_PM_WOW,
964+
.matches = { /* T16 G2 AMD #2 */
937965
DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
938966
DMI_MATCH(DMI_PRODUCT_NAME, "21K8"),
939967
},
940968
},
941969
{
942970
.driver_data = (void *)ATH11K_PM_WOW,
943-
.matches = {
971+
.matches = { /* P16s G2 AMD #1 */
972+
DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
973+
DMI_MATCH(DMI_PRODUCT_NAME, "21K9"),
974+
},
975+
},
976+
{
977+
.driver_data = (void *)ATH11K_PM_WOW,
978+
.matches = { /* P16s G2 AMD #2 */
944979
DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
945980
DMI_MATCH(DMI_PRODUCT_NAME, "21KA"),
946981
},
947982
},
948983
{
949984
.driver_data = (void *)ATH11K_PM_WOW,
950-
.matches = {
985+
.matches = { /* T14s G4 AMD #1 */
986+
DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
987+
DMI_MATCH(DMI_PRODUCT_NAME, "21F8"),
988+
},
989+
},
990+
{
991+
.driver_data = (void *)ATH11K_PM_WOW,
992+
.matches = { /* T14s G4 AMD #2 */
951993
DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),
952994
DMI_MATCH(DMI_PRODUCT_NAME, "21F9"),
953995
},

‎drivers/net/wireless/ath/ath11k/mac.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// SPDX-License-Identifier: BSD-3-Clause-Clear
22
/*
33
* Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
4-
* Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
4+
* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
55
*/
66

77
#include <net/mac80211.h>
@@ -4417,9 +4417,9 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
44174417
}
44184418

44194419
if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
4420-
flags |= WMI_KEY_PAIRWISE;
4420+
flags = WMI_KEY_PAIRWISE;
44214421
else
4422-
flags |= WMI_KEY_GROUP;
4422+
flags = WMI_KEY_GROUP;
44234423

44244424
ath11k_dbg(ar->ab, ATH11K_DBG_MAC,
44254425
"%s for peer %pM on vdev %d flags 0x%X, type = %d, num_sta %d\n",
@@ -4456,7 +4456,7 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
44564456

44574457
is_ap_with_no_sta = (vif->type == NL80211_IFTYPE_AP &&
44584458
!arvif->num_stations);
4459-
if ((flags & WMI_KEY_PAIRWISE) || cmd == SET_KEY || is_ap_with_no_sta) {
4459+
if (flags == WMI_KEY_PAIRWISE || cmd == SET_KEY || is_ap_with_no_sta) {
44604460
ret = ath11k_install_key(arvif, key, cmd, peer_addr, flags);
44614461
if (ret) {
44624462
ath11k_warn(ab, "ath11k_install_key failed (%d)\n", ret);
@@ -4470,7 +4470,7 @@ static int ath11k_mac_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
44704470
goto exit;
44714471
}
44724472

4473-
if ((flags & WMI_KEY_GROUP) && cmd == SET_KEY && is_ap_with_no_sta)
4473+
if (flags == WMI_KEY_GROUP && cmd == SET_KEY && is_ap_with_no_sta)
44744474
arvif->reinstall_group_keys = true;
44754475
}
44764476

‎drivers/net/wireless/ath/ath12k/mac.c‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -8290,23 +8290,32 @@ static void ath12k_mgmt_over_wmi_tx_drop(struct ath12k *ar, struct sk_buff *skb)
82908290
wake_up(&ar->txmgmt_empty_waitq);
82918291
}
82928292

8293-
int ath12k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx)
8293+
static void ath12k_mac_tx_mgmt_free(struct ath12k *ar, int buf_id)
82948294
{
8295-
struct sk_buff *msdu = skb;
8295+
struct sk_buff *msdu;
82968296
struct ieee80211_tx_info *info;
8297-
struct ath12k *ar = ctx;
8298-
struct ath12k_base *ab = ar->ab;
82998297

83008298
spin_lock_bh(&ar->txmgmt_idr_lock);
8301-
idr_remove(&ar->txmgmt_idr, buf_id);
8299+
msdu = idr_remove(&ar->txmgmt_idr, buf_id);
83028300
spin_unlock_bh(&ar->txmgmt_idr_lock);
8303-
dma_unmap_single(ab->dev, ATH12K_SKB_CB(msdu)->paddr, msdu->len,
8301+
8302+
if (!msdu)
8303+
return;
8304+
8305+
dma_unmap_single(ar->ab->dev, ATH12K_SKB_CB(msdu)->paddr, msdu->len,
83048306
DMA_TO_DEVICE);
83058307

83068308
info = IEEE80211_SKB_CB(msdu);
83078309
memset(&info->status, 0, sizeof(info->status));
83088310

8309-
ath12k_mgmt_over_wmi_tx_drop(ar, skb);
8311+
ath12k_mgmt_over_wmi_tx_drop(ar, msdu);
8312+
}
8313+
8314+
int ath12k_mac_tx_mgmt_pending_free(int buf_id, void *skb, void *ctx)
8315+
{
8316+
struct ath12k *ar = ctx;
8317+
8318+
ath12k_mac_tx_mgmt_free(ar, buf_id);
83108319

83118320
return 0;
83128321
}
@@ -8315,17 +8324,10 @@ static int ath12k_mac_vif_txmgmt_idr_remove(int buf_id, void *skb, void *ctx)
83158324
{
83168325
struct ieee80211_vif *vif = ctx;
83178326
struct ath12k_skb_cb *skb_cb = ATH12K_SKB_CB(skb);
8318-
struct sk_buff *msdu = skb;
83198327
struct ath12k *ar = skb_cb->ar;
8320-
struct ath12k_base *ab = ar->ab;
83218328

8322-
if (skb_cb->vif == vif) {
8323-
spin_lock_bh(&ar->txmgmt_idr_lock);
8324-
idr_remove(&ar->txmgmt_idr, buf_id);
8325-
spin_unlock_bh(&ar->txmgmt_idr_lock);
8326-
dma_unmap_single(ab->dev, skb_cb->paddr, msdu->len,
8327-
DMA_TO_DEVICE);
8328-
}
8329+
if (skb_cb->vif == vif)
8330+
ath12k_mac_tx_mgmt_free(ar, buf_id);
83298331

83308332
return 0;
83318333
}

‎drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5627,8 +5627,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
56275627
*cookie, le16_to_cpu(action_frame->len),
56285628
le32_to_cpu(af_params->channel));
56295629

5630-
ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
5631-
af_params);
5630+
ack = brcmf_p2p_send_action_frame(vif->ifp, af_params);
56325631

56335632
cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
56345633
GFP_KERNEL);

‎drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c‎

Lines changed: 10 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1529,6 +1529,7 @@ int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,
15291529
/**
15301530
* brcmf_p2p_tx_action_frame() - send action frame over fil.
15311531
*
1532+
* @ifp: interface to transmit on.
15321533
* @p2p: p2p info struct for vif.
15331534
* @af_params: action frame data/info.
15341535
*
@@ -1538,12 +1539,11 @@ int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,
15381539
* The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action
15391540
* frame is transmitted.
15401541
*/
1541-
static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p,
1542+
static s32 brcmf_p2p_tx_action_frame(struct brcmf_if *ifp,
1543+
struct brcmf_p2p_info *p2p,
15421544
struct brcmf_fil_af_params_le *af_params)
15431545
{
15441546
struct brcmf_pub *drvr = p2p->cfg->pub;
1545-
struct brcmf_cfg80211_vif *vif;
1546-
struct brcmf_p2p_action_frame *p2p_af;
15471547
s32 err = 0;
15481548

15491549
brcmf_dbg(TRACE, "Enter\n");
@@ -1552,14 +1552,7 @@ static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p,
15521552
clear_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, &p2p->status);
15531553
clear_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status);
15541554

1555-
/* check if it is a p2p_presence response */
1556-
p2p_af = (struct brcmf_p2p_action_frame *)af_params->action_frame.data;
1557-
if (p2p_af->subtype == P2P_AF_PRESENCE_RSP)
1558-
vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif;
1559-
else
1560-
vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
1561-
1562-
err = brcmf_fil_bsscfg_data_set(vif->ifp, "actframe", af_params,
1555+
err = brcmf_fil_bsscfg_data_set(ifp, "actframe", af_params,
15631556
sizeof(*af_params));
15641557
if (err) {
15651558
bphy_err(drvr, " sending action frame has failed\n");
@@ -1711,16 +1704,14 @@ static bool brcmf_p2p_check_dwell_overflow(u32 requested_dwell,
17111704
/**
17121705
* brcmf_p2p_send_action_frame() - send action frame .
17131706
*
1714-
* @cfg: driver private data for cfg80211 interface.
1715-
* @ndev: net device to transmit on.
1707+
* @ifp: interface to transmit on.
17161708
* @af_params: configuration data for action frame.
17171709
*/
1718-
bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
1719-
struct net_device *ndev,
1710+
bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp,
17201711
struct brcmf_fil_af_params_le *af_params)
17211712
{
1713+
struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
17221714
struct brcmf_p2p_info *p2p = &cfg->p2p;
1723-
struct brcmf_if *ifp = netdev_priv(ndev);
17241715
struct brcmf_fil_action_frame_le *action_frame;
17251716
struct brcmf_config_af_params config_af_params;
17261717
struct afx_hdl *afx_hdl = &p2p->afx_hdl;
@@ -1857,7 +1848,7 @@ bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
18571848
if (af_params->channel)
18581849
msleep(P2P_AF_RETRY_DELAY_TIME);
18591850

1860-
ack = !brcmf_p2p_tx_action_frame(p2p, af_params);
1851+
ack = !brcmf_p2p_tx_action_frame(ifp, p2p, af_params);
18611852
tx_retry++;
18621853
dwell_overflow = brcmf_p2p_check_dwell_overflow(requested_dwell,
18631854
dwell_jiffies);
@@ -2217,7 +2208,6 @@ static struct wireless_dev *brcmf_p2p_create_p2pdev(struct brcmf_p2p_info *p2p,
22172208

22182209
WARN_ON(p2p_ifp->bsscfgidx != bsscfgidx);
22192210

2220-
init_completion(&p2p->send_af_done);
22212211
INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);
22222212
init_completion(&p2p->afx_hdl.act_frm_scan);
22232213
init_completion(&p2p->wait_next_af);
@@ -2513,6 +2503,8 @@ s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced)
25132503
pri_ifp = brcmf_get_ifp(cfg->pub, 0);
25142504
p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif = pri_ifp->vif;
25152505

2506+
init_completion(&p2p->send_af_done);
2507+
25162508
if (p2pdev_forced) {
25172509
err_ptr = brcmf_p2p_create_p2pdev(p2p, NULL, NULL);
25182510
if (IS_ERR(err_ptr)) {

‎drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,8 +168,7 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp,
168168
int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,
169169
const struct brcmf_event_msg *e,
170170
void *data);
171-
bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
172-
struct net_device *ndev,
171+
bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp,
173172
struct brcmf_fil_af_params_le *af_params);
174173
bool brcmf_p2p_scan_finding_common_channel(struct brcmf_cfg80211_info *cfg,
175174
struct brcmf_bss_info_le *bi);

‎drivers/net/wireless/intel/iwlwifi/mld/link.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -501,6 +501,7 @@ void iwl_mld_remove_link(struct iwl_mld *mld,
501501
struct iwl_mld_vif *mld_vif = iwl_mld_vif_from_mac80211(bss_conf->vif);
502502
struct iwl_mld_link *link = iwl_mld_link_from_mac80211(bss_conf);
503503
bool is_deflink = link == &mld_vif->deflink;
504+
u8 fw_id = link->fw_id;
504505

505506
if (WARN_ON(!link || link->active))
506507
return;
@@ -513,10 +514,10 @@ void iwl_mld_remove_link(struct iwl_mld *mld,
513514

514515
RCU_INIT_POINTER(mld_vif->link[bss_conf->link_id], NULL);
515516

516-
if (WARN_ON(link->fw_id >= mld->fw->ucode_capa.num_links))
517+
if (WARN_ON(fw_id >= mld->fw->ucode_capa.num_links))
517518
return;
518519

519-
RCU_INIT_POINTER(mld->fw_id_to_bss_conf[link->fw_id], NULL);
520+
RCU_INIT_POINTER(mld->fw_id_to_bss_conf[fw_id], NULL);
520521
}
521522

522523
void iwl_mld_handle_missed_beacon_notif(struct iwl_mld *mld,

0 commit comments

Comments
 (0)