kernel/git/next/linux-next.git/drivers/net/wireless/ath, branch master

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/ath/ath.git

2026-09-16T12:23:51+00:00

# Conflicts: # drivers/net/wireless/ath/ath12k/wifi7/ahb.c

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git

2026-09-16T12:23:49+00:00

# Conflicts: # drivers/net/wireless/virtual/mac80211_hwsim_main.c # include/net/mac80211.h # net/mac80211/iface.c # net/mac80211/tx.c

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git

2026-09-16T11:36:29+00:00

wifi: mac80211: change public RX API to use link stations

2026-09-16T08:42:39+00:00

If a station is passed then the link ID also needs to be known. As such, it is a more natural API to simply pass the link station directly rather than pushing the link information into the RX status. Furthermore, having the link ID in the RX status is not actually correct because the link IDs are VIF specific and there may be multiple VIFs. In the case of a station this relationship is clear, but then one may as well use the link station. This patch only changes the API and emulates the old (incorrect) behaviour for now. The mac80211 RX code will be updated in later patches. Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20260915151925.06f41565116a.I4a2d45609e94b52654b10ec572e59a45d09c41f4@changeid Signed-off-by: Johannes Berg

wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()

2026-09-14T18:43:31+00:00

When mac80211 removes a sta, it calls .sta_state() which in turn calls ath11k_mac_station_remove(). In that function we clean up both peers & arsta related resources. But when the firmware crashes, ath11k calls ieee80211_restart_hw(), which assumes that all driver related resources are cleaned up beforehand. This cleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not in fact free arsta->rx_stats / tx_stats. Extract the arsta cleanup from ath11k_mac_station_remove() into a new ath11k_mac_station_cleanup() and call it from both there and ath11k_mac_peer_cleanup_all(). This should handle kmemleaks reports like: unreferenced object 0xffffff801ae66400 (size 1024): comm "hostapd", pid 1306, jiffies 4295011565 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc d61c08ec): kmemleak_alloc+0x3c/0x50 __kmalloc_cache_noprof+0x2b0/0x3e0 ath11k_mac_op_sta_state+0x1dc/0xb10 drv_sta_state+0xac/0x6f8 sta_info_insert_rcu+0x314/0x5e0 sta_info_insert+0x14/0x38 ieee80211_add_station+0x10c/0x1a0 nl80211_new_station+0x3e8/0x680 genl_family_rcv_msg_doit+0xc0/0x120 genl_rcv_msg+0x1b4/0x258 netlink_rcv_skb+0x4c/0x108 genl_rcv+0x38/0x60 netlink_unicast+0x190/0x278 netlink_sendmsg+0x15c/0x370 ____sys_sendmsg+0x120/0x290 ___sys_sendmsg+0x70/0xa0 Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1 Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Nicolas Escande Reviewed-by: Rameshkumar Sundaram Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20260731145830.769811-1-nico.escande@gmail.com Signed-off-by: Jeff Johnson

wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

2026-09-14T18:43:30+00:00

wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(), which only dequeues the timer and does not wait for a callback that is already executing; the preceding free_irq() calls synchronize the interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can therefore be running past the teardown and use the wcn freed along with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock, reads wcn->tx_ack_skb and passes wcn->hw to ieee80211_tx_status_irqsafe(). Fix this by using timer_shutdown_sync(), which waits for a running callback and also prevents the timer from being rearmed again. The timer is set up again by wcn36xx_dxe_init() on the next start, so the start/stop cycle is unaffected. This issue was found by an in-house static analysis tool. Fixes: fdf21cc37149 ("wcn36xx: Add TX ack support") Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Song Li Signed-off-by: Song Li Signed-off-by: Fan Wu Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20260910020907.3353-1-fanwu01@zju.edu.cn Signed-off-by: Jeff Johnson

wifi: ath12k: ahb: Revert undocumented ABI and dead code

2026-09-14T18:43:30+00:00

Commit 96f46607bbce ("wifi: ath12k: add AHB platform descriptor support") added undocumented OF ABI, by relying on a very specific node name. This is not allowed and was never acked by Devicetree maintainers. Additionally that part of code is not even used, because all devices have exactly the same user pd, so this was added "for future". Adding dead code just "for future" is heavily discouraged in kernel coding. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20260825081313.71351-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Jeff Johnson

wifi: ath12k: add support to load shared firmware on multiPD

2026-09-10T21:29:09+00:00

IPQ5332 platform uses a MultiPD architecture where multiple firmware instances share common read-only code segments. The driver currently loads only the per-UserPD firmware, which leaves the shared read-only firmware unloaded. Add support for loading the shared read-only firmware once before the UserPDs are powered up. The shared segment contains common code that is identical across all UserPDs and reduces the total firmware memory requirement. Store the reserved memory mapping in struct ath12k_ahb_rproc_info so it can be shared by all UserPDs and mapped only once. Keep the mapping valid across UserPD power cycles, and unmap it when the last UserPD is removed. Shut down the shared firmware from the rproc deconfiguration path when the last UserPD is removed. Also, pass NULL for the reloc_base parameter because the driver uses fixed memory regions configured through device tree and does not need the adjusted physical address after relocation. Tested-on: IPQ5332 hw1.0 AHB WLAN.WBE.1.6-01275-QCAHKSWPL_SILICONZ-1 Signed-off-by: Aaradhana Sahu Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260811054316.518494-1-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson

wifi: ath9k: use rcu_dereference_bh() for sta->rates in ath_merge_ratetbl()

2026-09-10T21:29:09+00:00

Commit c4f518736472 ("wifi: ath9k: Remove redundant rcu_read_lock/unlock() in spin_lock") removed the explicit rcu_read_lock()/rcu_read_unlock() pair from ath_txq_schedule(), relying on spin_lock_bh() to provide an implicit RCU read-side critical section. That is correct on kernels without CONFIG_DEBUG_LOCK_ALLOC, where rcu_read_lock_any_held() falls back to !preemptible() as a proxy, and spin_lock_bh() disables preemption. However, rcu_dereference() in ath_merge_ratetbl() checks rcu_read_lock_held(), which under CONFIG_DEBUG_LOCK_ALLOC only returns true when lock_is_held(&rcu_lock_map) — set exclusively by an explicit rcu_read_lock(). A spin_lock_bh() does not set rcu_lock_map, so on a CONFIG_DEBUG_LOCK_ALLOC + CONFIG_PROVE_RCU kernel, any call path that reaches ath_merge_ratetbl() with a non-NULL sta will produce a lockdep splat. The correct fix is to use rcu_dereference_bh(), whose validity check calls rcu_read_lock_bh_held(), which returns true whenever BH is disabled (in_softirq() || irqs_disabled()). This matches the actual protection at all callers of ath_set_rates() that pass a non-NULL sta: they all hold a spin_lock_bh() (either sc->chan_lock or txq->axq_lock). Fixes: c4f518736472 ("wifi: ath9k: Remove redundant rcu_read_lock/unlock() in spin_lock") Assisted-by: LLM Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20260813-ath9k-rcu-fix-v1-1-424665a1ce60@oss.qualcomm.com Signed-off-by: Jeff Johnson

wifi: ath12k: preserve PPDU state across monitor status buffers

2026-09-09T17:54:48+00:00

A monitor PPDU may span multiple status buffers. However, __ath12k_wifi7_dp_mon_process_ring() clears mon_ppdu_info before processing every buffer. As a result, continuation buffers lose PPDU state collected from earlier buffers, including ppdu_id and PHY metadata. This can cause monitor RX processing to fail when ath12k_wifi7_dp_rx_mon_dest_process() observes a PPDU ID mismatch between status and destination rings, preventing MSDUs from being delivered. It can also produce incomplete EHT metadata that triggers warnings from mac80211: Rate marked as an EHT rate but data is invalid: MCS:0, NSS:0 ath12k_wifi7_dp_mon_srng_process() already tracks status TLV continuations via ppdu_continuation. Apply the same logic here and only reinitialize mon_ppdu_info when starting a new PPDU. mon_ppdu_info persists across ar->monitor_started transitions. If monitor mode stops while a PPDU is mid-continuation, ppdu_continuation stays set and could leak into the next monitor session. Reset it when monitor mode starts. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3 Fixes: 78d3d907d0f1 ("wifi: ath12k: add support to reap and process monitor status ring") Signed-off-by: Kang Yang Reviewed-by: Baochen Qiang Reviewed-by: Tamizh Chelvam Raja Link: https://patch.msgid.link/20260828065534.1537-1-kang.yang@oss.qualcomm.com Signed-off-by: Jeff Johnson