kernel/net/mac80211/chan.c, branch master

mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations

2026-03-06T10:08:43Z

ieee80211_chan_bw_change() iterates all stations and accesses link->reserved.oper via sta->sdata->link[link_id]. For stations on AP_VLAN interfaces (e.g. 4addr WDS clients), sta->sdata points to the VLAN sdata, whose link never participates in chanctx reservations. This leaves link->reserved.oper zero-initialized with chan == NULL, causing a NULL pointer dereference in __ieee80211_sta_cap_rx_bw() when accessing chandef->chan->band during CSA. Resolve the VLAN sdata to its parent AP sdata using get_bss_sdata() before accessing link data. Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Link: https://patch.msgid.link/20260305170812.2904208-1-nbd@nbd.name [also change sta->sdata in ARRAY_SIZE even if it doesn't matter] Signed-off-by: Johannes Berg

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51Z

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28Z

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

wifi: mac80211: don't iterate not running interfaces

2026-01-08T12:33:10Z

for_each_chanctx_user_* was introdcued as a replacement for for_each_sdata_link, which visits also other chanctx users that are not link. for_each_sdata_link skips not running interfaces, do the same for for_each_chanctx_user_* Fixes: 1ce954c98b89 ("wifi: mac80211: add and use chanctx usage iteration") Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20260107143736.55c084e2a976.I38b7b904a135dadca339321923b501b2c2c5c8c0@changeid Signed-off-by: Johannes Berg

wifi: mac80211: allow sharing identical chanctx for S1G interfaces

2025-11-26T09:34:51Z

Introduce support for sharing identical channel contexts for S1G interfaces. Additionally, do not downgrade channel requests for S1G interfaces. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20251126015758.149034-1-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg

wifi: mac80211: fix channel switching code

2025-11-24T12:05:11Z

My prior commit here introduced a bug due to copy/paste, it was iterating the links assigned to 'ctx->replace_ctx' and I replaced it by iterating links assigned to 'ctx' by accident, then modified it for the iteration later. Fix it to iterate the users of the correct chanctx, i.e. 'ctx->replace_ctx'. Ultimately, this issue led to a crash in a hwsim test (multi_ap_wps_shared_apdev_csa) because it would actually do the switch (rather than refuse here) and then later have a double-free of the original chanctx, because it was still in use by another interface yet freed as part of the switching. Fixes: a1dc648aa76d ("wifi: mac80211: remove chanctx to link back-references") Link: https://patch.msgid.link/20251121113733.7710a58d45eb.Ie9ec010b52b1baed93dbe44f968c2119b6b5d98d@changeid Signed-off-by: Johannes Berg

wifi: mac80211: add and use chanctx usage iteration

2025-11-10T09:38:50Z

In preparation for NAN interfaces using multiple channel contexts, add an iterator macro that iterates all users of a given channel context. The logic during reserved assign/reassign handling the bandwidth in ieee80211_get_chanctx_max_required_bw() is a bit more complicated and should be cleaned up, so it isn't yet converted. Link: https://patch.msgid.link/20251105160431.5aaccc2f127d.I2b7fd0858a263916f43abab49c6d3cc0b5aa16ec@changeid Signed-off-by: Johannes Berg

wifi: mac80211: simplify ieee80211_recalc_chanctx_min_def() API

2025-11-10T09:38:50Z

ieee80211_recalc_chanctx_min_def() is used outside the chandef code, but then should/is always used with NULL/false for the two last arguments. Remove them, and create another level of indirection for use inside the file. Link: https://patch.msgid.link/20251105160431.33408844c392.I4f52298861780c17a27cd229609e8a3e29c8d740@changeid Signed-off-by: Johannes Berg

wifi: mac80211: remove chanctx to link back-references

2025-11-10T09:38:49Z

Each link can currently use a chanctx and have another one reserved, and both of these are also tracked backwards in the assigned_links and reserved_links lists. If we consider that there aren't *that* many links, this duplicate book- keeping isn't necessary. (I think it used to be necessary before the wiphy locking changes, when chanctx_mtx existed, because we couldn't do any interface iterations while holding only chanctx_mtx.) Additionally, for NAN, we're going to want to track which chanctxs are in use by the (group of) NAN interfaces. For those, links don't really make sense as such, so chanctxs need to be assigned to a different data structure. Thus, as a first step, remove those back-lists of users (right now only links) of each channel context. This is a very basic conversion, ieee80211_vif_use_reserved_switch() should made to iterate smarter. Link: https://patch.msgid.link/20251105160431.dbeea1c42e76.I8d273c407274e1c05a4778aa20b56a9f326e87a7@changeid Signed-off-by: Johannes Berg

wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work

2025-10-28T13:56:42Z

The work item may be scheduled relatively far in the future. As the event happens at a specific point in time, the normal timer accuracy is not sufficient in that case. Switch to use wiphy_hrtimer_work so that the accuracy is sufficient. To make this work, use the same clock to store the timestamp. CC: stable@vger.kernel.org Fixes: ec3252bff7b6 ("wifi: mac80211: use wiphy work for channel switch") Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20251028125710.68258c7e4ac4.I4ff2b2cdffbbf858bf5f08baccc7a88c4f9efe6f@changeid Signed-off-by: Johannes Berg