kernel/git/stable/linux.git/net/mac80211/tx.c, branch master

wifi: mac80211: skip unused probe response countdown offsets

2026-08-02T16:23:27+00:00

mac80211 copies cfg80211's variable-length countdown offset list into a zero-initialized fixed-size array, leaving unused entries at zero. The beacon branch already skips those zero entries, but the AP probe-response branch writes through them unconditionally. When a probe-response template has no countdown offset, the write through an unused zero entry overwrites resp->data[0], corrupting the first byte of the template. cfg80211 already bounds explicitly supplied non-zero offsets in nl80211_parse_counter_offsets(), so this is a zero-sentinel bug, not an out-of-bounds write. Skip zero probe-response offsets, matching the beacon path. Fixes: af296bdb8da4 ("mac80211: move csa counters from sdata to beacon/presp") Link: https://lore.kernel.org/all/20260708195911.84365-6-enderaoelyther@gmail.com/ Assisted-by: Codex:gpt-5 Assisted-by: Claude:opus-4.8 Signed-off-by: Zhao Li Link: https://patch.msgid.link/20260723011001.76851-1-enderaoelyther@gmail.com Signed-off-by: Johannes Berg

wifi: cfg80211: convert tx_control_port cookie to input parameter

2026-08-02T15:40:08+00:00

The tx_control_port op was excluded from the previous commit because a NULL cookie was affecting different behavior, ie. signalling that no TX status is wanted. Since cfg80211_assign_cookie() guarantees a non-zero value, cookie value 0 can be used instead. So pass 0 when dont_wait_for_ack is set, otherwise pass value returned from cfg80211_assign_cookie() call. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20260731123509.1975281-13-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg

wifi: mac80211: stop using ieee80211_mgmt_tx_cookie()

2026-08-02T15:40:06+00:00

Now that cfg80211 pre-assigns the cookie before calling into mac80211, stop calling ieee80211_mgmt_tx_cookie() in all affected paths: - ieee80211_start_roc_work(): for normal ROC use the pre-assigned value directly instead of generating a new one. - ieee80211_attach_ack_skb(): the cookie is already set by the caller; remove the ieee80211_mgmt_tx_cookie() call and store it in the ack SKB as-is. This covers both mgmt_tx and probe_peer since both call ieee80211_attach_ack_skb(). - ieee80211_mgmt_tx(): the dummy 0xffffffff assignment for the dont_wait_for_ack case is no longer needed; cfg80211_assign_cookie() guarantees a non-zero value which is sufficient for the internal ROC vs mgmt-tx distinction. - ieee80211_store_ack_skb(): same fix for the tx_control_port path. With no remaining callers, remove ieee80211_mgmt_tx_cookie() and the roc_cookie_counter field from struct ieee80211_local. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20260731123509.1975281-3-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg

Revert "wifi: mac80211: don't encrypt pre-auth (ETH_P_PREAUTH) frames"

2026-08-02T15:39:01+00:00

This reverts commit dd406779999fa2065ec6b7c4f80906b727041d2c. Never encrypting the frames broke a number of tests that do additional pre-authentication while already connected, and then the frames didn't go out correctly. Whatever this was intended to fix, this wasn't the right fix. Fixes: dd406779999f ("wifi: mac80211: don't encrypt pre-auth (ETH_P_PREAUTH) frames") Signed-off-by: Johannes Berg

wifi: mac80211: add ieee80211_txq_aql_pending()

2026-07-28T14:02:03+00:00

Add a function to allow drivers to query the pending AQL airtime for a given txq, for both unicast and broadcast. This will be used for mt76 to limit buffering in AP mode for power-save stations. Signed-off-by: Felix Fietkau Link: https://patch.msgid.link/20260724115429.3921457-4-nbd@nbd.name Signed-off-by: Johannes Berg

wifi: mac80211: add AQL support for multicast packets

2026-07-28T14:02:03+00:00

Excessive multicast traffic with little competing unicast traffic can easily flood hardware queues, leading to throughput issues. Additionally, filling the hardware queues with too many packets breaks FQ for multicast data. Fix this by enabling AQL for multicast packets. Signed-off-by: Felix Fietkau Link: https://patch.msgid.link/20260724115429.3921457-3-nbd@nbd.name Signed-off-by: Johannes Berg

Merge tag 'wireless-2026-07-26' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next

2026-07-27T23:03:40+00:00

Johannes Berg says: ==================== wireless-next-2026-07-26 Mostly driver changes this time: - new driver mm81x for an S1G device - new driver nxpwifi for NXP devices (mostly forked off from mwifiex) - ath12k: much kernel infrastructure integration work - brcmfmac: DPP support, some Cypress part update - nl80211: per-link statistics support ==================== Link: https://patch.msgid.link/20260726105205.942922-60-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski

wifi: mac80211: don't encrypt pre-auth (ETH_P_PREAUTH) frames

2026-07-21T17:18:52+00:00

Pre-authentication frames (ETH_P_PREAUTH, 0x88C7) are sent before the authentication handshake completes with the target AP, so no encryption key exists for them yet. Unlike normal EAPOL frames (ETH_P_8021X, 0x888E) which are registered as the control port protocol, pre-auth frames are not recognized as control port frames, causing the kernel to incorrectly assign the current AP's key and attempt encryption, resulting in a WARN_ON in ieee80211_encrypt_tx_skb when the cipher is not handled. Fix this by setting IEEE80211_TX_INTFL_DONT_ENCRYPT for pre-auth frames in ieee80211_tx_h_check_control_port_protocol(), so that key selection skips them and they are sent unencrypted as intended. Note that the only driver hitting this path is hwsim. Reported-by: syzbot+b6ce23950fd636e6efb6@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b6ce23950fd636e6efb6 Signed-off-by: Deepanshu Kartikey Link: https://patch.msgid.link/20260713015946.44636-1-kartikey406@gmail.com [add note about hwsim, fix subject] Signed-off-by: Johannes Berg

wifi: mac80211: Route (Re)association req/response to per-STA queue

2026-07-07T08:16:31+00:00

An association request or response frame is generally delivered to the driver without a TX queue object. However, with drivers that do encryption offload and couple the key with a transmit queue, this means that the frames are not being encrypted. Fix this by routing the association frames to the management TXQ. This will allow the driver to set up the required resources before transmitting the association frame, e.g., set up keys etc. Signed-off-by: Ilan Peer Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260706222925.febcc62f485c.Iff932880e4b98232cbf6ba405fbb90d650a85381@changeid Signed-off-by: Johannes Berg

wifi: mac80211: free ack status frame on TX header build failure

2026-07-06T12:11:07+00:00

ieee80211_build_hdr() stores an ACK status frame before it has finished all validation and header construction. If a later error path is taken, the transmit skb is freed but the stored ACK status frame remains in local->ack_status_frames. This can happen for control port frames when the requested MLO link ID does not match the link selected for a non-MLO station. Repeated failures can fill the ACK status IDR and leave pending ACK frames until hardware teardown. Remove any stored ACK status frame before returning an error after it has been inserted into the IDR. Fixes: a729cff8ad51 ("mac80211: implement wifi TX status") Cc: stable@vger.kernel.org Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Assisted-by: Codex:gpt-5.4 Signed-off-by: Zhiling Zou Signed-off-by: Ren Wei Link: https://patch.msgid.link/9de0423da840e92084915b8f92e66a421245c4b8.1782462409.git.roxy520tt@gmail.com Signed-off-by: Johannes Berg