kernel/drivers/net/wireless/mediatek, branch linux-rolling-stable

wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()

2026-03-12T11:09:51Z

[ Upstream commit 4e10a730d1b511ff49723371ed6d694dd1b2c785 ] Check frame length before accessing the mgmt fields in mt76_connac2_mac_write_txwi_80211 in order to avoid a possible oob access. Fixes: 577dbc6c656d ("mt76: mt7915: enable offloading of sequence number assignment") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-3-b0f6d1ad4850@kernel.org [fix check to also cover mgmt->u.action.u.addba_req.capab, correct Fixes tag] Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin

wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()

2026-03-12T11:09:51Z

[ Upstream commit c41a9abd6ae31d130e8f332e7c8800c4c866234b ] Check frame length before accessing the mgmt fields in mt7925_mac_write_txwi_80211 in order to avoid a possible oob access. Fixes: c948b5da6bbec ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-2-b0f6d1ad4850@kernel.org Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin

wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()

2026-03-12T11:09:51Z

[ Upstream commit 60862846308627e9e15546bb647a00de44deb27b ] Check frame length before accessing the mgmt fields in mt7996_mac_write_txwi_80211 in order to avoid a possible oob access. Fixes: 98686cd21624c ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20260226-mt76-addba-req-oob-access-v1-1-b0f6d1ad4850@kernel.org Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin

wifi: mt76: Remove blank line after mt792x firmware version dmesg

2026-01-01T01:03:35Z

An extra blank line gets printed after printing firmware version because the build date is null terminated. Remove the "\n" from dev_info() calls to print firmware version and build date to fix the problem. Reported-by: Mario Limonciello Signed-off-by: Shuah Khan Signed-off-by: Linus Torvalds

Revert "wifi: mt76: Strip whitespace from build ddate"

2026-01-01T01:03:35Z

This reverts commit f804a5895ebad2b2d4fb8a3688d2115926e993d5. This change introduced the following panic, and mt792x_load_firmware() fails. wifi is dead on systems with mt792x wireless. kern :crit : kernel BUG at lib/string_helpers.c:1043! kern :warn : Oops: invalid opcode: 0000 [#1] SMP NOPTI kern :warn : CPU: 14 UID: 0 PID: 61 Comm: kworker/14:0 Tainted: G W 6.19.0-rc1 #1 PREEMPT(voluntary) kern :warn : Tainted: [W]=WARN kern :warn : Hardware name: Framework Laptop 13 (AMD Ryzen 7040Series)/FRANMDCP07, BIOS 03.16 07/25/2025 kern :warn : Workqueue: events mt7921_init_work [mt7921_common] kern :warn : RIP: 0010:__fortify_panic+0xd/0xf kern :warn : Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 40 0f b6 ff e8 c3 55 71 00 <0f> 0b 48 8b 54 24 10 48 8b 74 24 08 4c 89 e9 48 c7 c7 00 a2 d5 a0 kern :warn : RSP: 0018:ffffa7a5c03a3d10 EFLAGS: 00010246 kern :warn : RAX: ffffffffa0d7aaf2 RBX: 0000000000000000 RCX: ffffffffa0d7aaf2 kern :warn : RDX: 0000000000000011 RSI: ffffffffa0d5a170 RDI: ffffffffa128db10 kern :warn : RBP: ffff91650ae52060 R08: 0000000000000010 R09: ffffa7a5c31b2000 kern :warn : R10: ffffa7a5c03a3bf0 R11: 00000000ffffffff R12: 0000000000000000 kern :warn : R13: ffffa7a5c31b2000 R14: 0000000000001000 R15: 0000000000000000 kern :warn : FS: 0000000000000000(0000) GS:ffff91743e664000(0000) knlGS:0000000000000000 kern :warn : CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kern :warn : CR2: 00007f10786c241c CR3: 00000003eca24000 CR4: 0000000000f50ef0 kern :warn : PKRU: 55555554 kern :warn : Call Trace: kern :warn : kern :warn : mt76_connac2_load_patch.cold+0x2b/0xa41 [mt76_connac_lib] kern :warn : ? srso_alias_return_thunk+0x5/0xfbef5 kern :warn : mt792x_load_firmware+0x36/0x150 [mt792x_lib] kern :warn : mt7921_run_firmware+0x2c/0x4a0 [mt7921_common] kern :warn : ? srso_alias_return_thunk+0x5/0xfbef5 kern :warn : ? mt7921_rr+0x12/0x30 [mt7921e] kern :warn : ? srso_alias_return_thunk+0x5/0xfbef5 kern :warn : ? ____mt76_poll_msec+0x75/0xb0 [mt76] kern :warn : mt7921e_mcu_init+0x4c/0x7a [mt7921e] kern :warn : mt7921_init_work+0x51/0x190 [mt7921_common] kern :warn : process_one_work+0x18b/0x340 kern :warn : worker_thread+0x256/0x3a0 kern :warn : ? __pfx_worker_thread+0x10/0x10 kern :warn : kthread+0xfc/0x240 kern :warn : ? __pfx_kthread+0x10/0x10 kern :warn : ? __pfx_kthread+0x10/0x10 kern :warn : ret_from_fork+0x254/0x290 kern :warn : ? __pfx_kthread+0x10/0x10 kern :warn : ret_from_fork_asm+0x1a/0x30 kern :warn : Signed-off-by: Shuah Khan Signed-off-by: Linus Torvalds

mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()

2025-11-24T14:01:54Z

In mt7615_mcu_wtbl_sta_add(), an skb sskb is allocated. If the subsequent call to mt76_connac_mcu_alloc_wtbl_req() fails, the function returns an error without freeing sskb, leading to a memory leak. Fix this by calling dev_kfree_skb() on sskb in the error handling path to ensure it is properly released. Fixes: 99c457d902cf9 ("mt76: mt7615: move mt7615_mcu_set_bmc to mt7615_mcu_ops") Signed-off-by: Zilin Guan Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251113062415.103611-1-zilin@seu.edu.cn Signed-off-by: Felix Fietkau

wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load

2025-11-24T14:01:30Z

Set the MT76_STATE_MCU_RUNNING bit only after mt7921_load_clc() has successfully completed. Previously, the MCU_RUNNING state was set before loading CLC, which could cause conflict between chip mcu_init retry and mac_reset flow, result in chip init fail and chip abnormal status. By moving the state set after CLC load, firmware initialization becomes robust and resolves init fail issue. Signed-off-by: Quan Zhou Reviewed-by: druth@chromium.org Link: https://patch.msgid.link/19ec8e4465142e774f17801025accd0ae2214092.1763465933.git.quan.zhou@mediatek.com Signed-off-by: Felix Fietkau

wifi: mt76: Strip whitespace from build ddate

2025-11-24T13:59:13Z

On systems I have with mt7925 cards I've been noticing a blank line in my kernel logs. IE: ``` [ 17.294105] mt7925e 0000:c3:00.0: HW/SW Version: 0x8a108a10, Build Time: 20250721232852a [ 17.314233] r8169 0000:c4:00.0 enp196s0f0: Link is Down ``` This is because the build_date from the header has a newline character as does the dev_info() print. As the firmware isn't guaranteed to always have a newline but the print is, copy the firmware build date to a temporary variable and strip any whitespace from it before showing it in the logs. Signed-off-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20251120155829.3494747-1-superm1@kernel.org Signed-off-by: Felix Fietkau

wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work()

2025-11-24T13:59:13Z

Grab the mt76 mutex running mt7996_mac_sta_rc_work() since it is required by mt7996_mcu_add_rate_ctrl routine. Fixes: 28d519d0d493a ("wifi: mt76: Move RCU section in mt7996_mcu_add_rate_ctrl_fixed()") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20251118-mt7996-rc-work-missing-mtx-v1-1-0739c493a6cb@kernel.org Signed-off-by: Felix Fietkau

wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove

2025-11-24T13:59:13Z

mt7996_vif_link_remove routine is executed by mt76_scan_complete() without holding the wiphy mutex triggering the following lockdep warning. WARNING: CPU: 0 PID: 72 at net/mac80211/key.c:1029 ieee80211_iter_keys+0xe4/0x1a0 [mac80211] CPU: 0 UID: 0 PID: 72 Comm: kworker/u32:2 Tainted: G S 6.18.0-rc5+ #27 PREEMPT(full) Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/15/2023 Workqueue: phy3 mt76_scan_work [mt76] RIP: 0010:ieee80211_iter_keys+0xe4/0x1a0 [mac80211] Code: 4c 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 48 8b 47 48 be ff ff ff ff 48 8d 78 68 e8 b4 eb 1e e1 85 c0 0f 85 49 ff ff ff 4c 8b ab 90 1a 00 00 48 8d 83 90 RSP: 0018:ffffc900002f7cb0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888127e00ee0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff888127e00788 RDI: ffff88811132b5c8 RBP: ffffffffa0ddf400 R08: 0000000000000001 R09: 000000009dcc1dac R10: 0000000000000001 R11: ffff88811132b5a0 R12: ffffc900002f7d00 R13: ffff8882581e6a80 R14: ffff888127e0afc8 R15: ffff888158832038 FS: 0000000000000000(0000) GS:ffff8884da486000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000030a0fd90 CR3: 0000000002c52004 CR4: 00000000003706f0 Call Trace: ? lock_acquire+0xc2/0x2c0 mt7996_vif_link_remove+0x64/0x2b0 [mt7996e] mt76_put_vif_phy_link+0x41/0x50 [mt76] mt76_scan_complete+0x77/0x100 [mt76] mt76_scan_work+0x2eb/0x3f0 [mt76] ? process_one_work+0x1e5/0x6d0 process_one_work+0x221/0x6d0 worker_thread+0x19a/0x340 ? rescuer_thread+0x450/0x450 kthread+0x108/0x220 ? kthreads_online_cpu+0x110/0x110 ret_from_fork+0x1c6/0x220 ? kthreads_online_cpu+0x110/0x110 ret_from_fork_asm+0x11/0x20 irq event stamp: 45471 hardirqs last enabled at (45477): [] __up_console_sem+0x5e/0x70 hardirqs last disabled at (45482): [] __up_console_sem+0x43/0x70 softirqs last enabled at (44500): [] napi_pp_put_page+0xac/0xd0 softirqs last disabled at (44498): [] page_pool_put_unrefed_netmem+0x290/0x3d0 ---[ end trace 0000000000000000 ]--- Fix the issue skipping ieee80211_iter_keys() for scanning links in mt7996_vif_link_remove routine since we have not uploaded any hw keys for these links. Fixes: 04414d7bba78 ("wifi: mt76: mt7996: delete vif keys when requested") Signed-off-by: Lorenzo Bianconi Tested-by: Ben Greear Link: https://patch.msgid.link/20251115-mt7996-key-iter-link-remove-fix-v1-1-4f3f4e1eaa78@kernel.org Signed-off-by: Felix Fietkau