kernel/git/next/linux-next.git/drivers/net/wireless/broadcom, branch master

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git

2026-07-14T12:52:05+00:00

Merge tag 'wireless-2026-07-09' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

2026-07-10T14:27:45+00:00

Johannes Berg says: ==================== Too many robustness fixes to list. Mostly for - slight out-of-bounds reads of SKBs, - leaks on error conditions, and - malformed netlink input rejection. * tag 'wireless-2026-07-09' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (46 commits) wifi: cfg80211: bound element ID read when checking non-inheritance wifi: brcmfmac: cyw: fix heap overflow on a short auth frame wifi: brcmfmac: initialize SDIO data work before cleanup wifi: cfg80211: validate assoc response length before status and IE access wifi: cfg80211: validate rx/tx MLME callback frame lengths before access wifi: mac80211: ibss: wait for in-flight TX on disconnect wifi: mac80211: recalculate rx_nss on IBSS peer capability update wifi: cfg80211: use wiphy work for socket owner autodisconnect wifi: mac80211: fix memory leak in ieee80211_register_hw() wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock wifi: mac80211: validate deauth frame length before reason access wifi: mac80211: avoid non-S1G AID fallback for S1G assoc wifi: cfg80211: reject empty PMSR peer lists wifi: cfg80211: reject unsupported PMSR FTM location requests wifi: cfg80211: validate PMSR FTM preamble range wifi: cfg80211: validate PMSR measurement type data wifi: nl80211: constrain MBSSID TX link ID range wifi: nl80211: validate nested MBSSID IE blobs wifi: ieee80211: validate MLE common info length wifi: cfg80211: derive S1G beacon TSF from S1G fields ... ==================== Link: https://patch.msgid.link/20260709115038.243870-3-johannes@sipsolutions.net Signed-off-by: Paolo Abeni

wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

2026-07-07T08:22:35+00:00

brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data); ... memcpy(&mgmt_frame->u, frame, mgmt_frame_len - offsetof(struct ieee80211_mgmt, u)); The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When mgmt_frame_len is below that, the subtraction wraps as an unsigned value to a huge length. The memcpy then runs far past the kzalloc'd buffer. A malicious or malfunctioning AP can make the frame short during the external SAE auth exchange, so this is a remotely triggered heap overflow. Reject frames shorter than the management header offset before the copy. Fixes: 66f909308a7c ("wifi: brcmfmac: cyw: support external SAE authentication in station mode") Link: https://lore.kernel.org/r/178214417708.2368577.16740907093694208834@maoyixie.com Cc: stable@vger.kernel.org Co-developed-by: Kaixuan Li Signed-off-by: Kaixuan Li Signed-off-by: Maoyi Xie Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260627131313.3878893-1-maoyixie.tju@gmail.com Signed-off-by: Johannes Berg

wifi: brcmfmac: initialize SDIO data work before cleanup

2026-07-07T08:10:40+00:00

brcmf_sdio_probe() stores the newly allocated bus in sdiodev->bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls brcmf_sdio_remove(). brcmf_sdio_remove() unconditionally cancels bus->datawork. Initialize the work item before the first failure path that can reach brcmf_sdio_remove(), so the cleanup path always observes a valid work object. This issue was found by our static analysis tool and then confirmed by manual review of the probe error path and the remove-time work drain. The problem pattern is an early setup failure that reaches a cleanup helper which cancels an embedded work item before its initializer has run. A QEMU PoC forced alloc_ordered_workqueue() to fail at the same point in brcmf_sdio_probe(), before INIT_WORK(&bus->datawork) is reached. The resulting fail path calls brcmf_sdio_remove(), and DEBUG_OBJECTS reports the invalid work drain with brcmf_sdio_probe() and brcmf_sdio_remove() in the stack. Fixes: 9982464379e8 ("brcmfmac: make sdio suspend wait for threads to freeze") Signed-off-by: Runyu Xiao Acked-by: Arend van Spriel Link: https://patch.msgid.link/20260619064401.1048976-1-runyu.xiao@seu.edu.cn Signed-off-by: Johannes Berg

wifi: b43, b43legacy: debugfs: use kzalloc() to allocate formatting buffers

2026-07-06T10:58:07+00:00

b43* debugfs functions allocate 16 KiB buffers for formatting debug output text using __get_free_pages(). kzalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object and for 16 Kib allocation kzalloc() will anyway delegate it to buddy. Replace use of __get_free_pages() with kzalloc(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Signed-off-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/20260701-b4-drivers-wireless-v1-1-60264cdf2efe@kernel.org Signed-off-by: Johannes Berg

Replace by more specific (c files)

2026-07-03T05:38:17+00:00

Replace the #include of by the more specific where applicable. For most cases the include can be dropped completely, only a few drivers need one or two headers added. Acked-by: Danilo Krummrich Acked-by: Takashi Sakamoto Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub)

b43: add RF power offset for N-PHY r8 + radio 2057 r8

2026-06-10T08:27:56+00:00

Add the 2.4 GHz RF power offset table for N-PHY rev 8 paired with radio 2057 rev 8 and wire it to the existing dispatcher. b43_ntab_get_rf_pwr_offset_table() currently dispatches on phy->rev == 17 (radio_rev 14) and phy->rev == 16 (radio_rev 9) for 2.4 GHz. phy->rev == 8 falls through and the function logs: b43-phyX ERROR: No 2GHz RF power table available for this device Add a phy->rev == 8 / radio_rev == 8 case returning the new table. The values are sourced from the proprietary Broadcom wl driver's nphy_papd_padgain_dlt_2g_2057rev5 array. Reusing the rev 5 values is structurally appropriate: the IPA TX gain table added by the preceding patch in this series shares the low 24 bits of every entry with rev 5 - same gain step amplitudes, only the PAD-gain selector byte differs. b43's pad_gain extraction in b43_nphy_tx_pwr_ctl_init() reads bits 19..23 of the gain entry, which sit in the shared low-24-bit range; the same gain index therefore maps to the same physical PAD gain code on both revisions and warrants the same per-index dB offset. Note that b43_nphy_tx_gain_table_upload() currently has a "TODO: Enable this once we have gains configured" early-return for phy->rev >= 7. With that early-return in place, this table is fetched (silencing the b43err that would otherwise abort PHY init) but its values are not yet written to MMIO. Resolving the TODO is a future, separate task. Assisted-by: Claude:claude-4.7-opus Signed-off-by: Alessio Ferri Acked-by: Michael Büsch Reviewed-by: Joshua Peisach Link: https://patch.msgid.link/20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-7-464566194d47@gmail.com Signed-off-by: Johannes Berg

b43: add channel info table for N-PHY r8 + radio 2057 r8

2026-06-10T08:27:55+00:00

Add the 2.4 GHz channel info table for N-PHY rev 8 paired with radio 2057 rev 8 and wire it to the existing dispatcher in r2057_get_chantabent_rev7(). The dispatcher's case 8 currently handles radio_rev == 5 only. For radio_rev == 8 both output pointers stay NULL, b43_nphy_set_channel() returns an error and channel switch to the default channel fails. The new b43_nphy_chantab_phy_rev8_radio_rev8[] is 14 entries covering the standard 2.4 GHz channel set (2412..2472 in 5 MHz steps, plus 2484 for channel 14). Values extracted from an MMIO dump of the proprietary Broadcom wl driver running on BCM6362 silicon (wl driver 6.30.102.7). Assisted-by: Claude:claude-4.7-opus Signed-off-by: Alessio Ferri Acked-by: Michael Büsch Reviewed-by: Joshua Peisach Link: https://patch.msgid.link/20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-6-464566194d47@gmail.com Signed-off-by: Johannes Berg

b43: add IPA TX gain table for N-PHY r8 + radio 2057 r8

2026-06-10T08:27:54+00:00

Add the 2.4 GHz IPA TX gain table for N-PHY rev 8 paired with radio 2057 rev 8 and wire it to the existing dispatcher. b43_nphy_get_ipa_gain_table() in tables_nphy.c currently handles case 8 only for radio_rev == 5; radio_rev == 8 falls through and the function logs: b43-phyX ERROR: No 2GHz IPA gain table available for this device b43-phyX ERROR: PHY init: Channel switch to default failed leaving b43_phy_init() to return an error and core_init to abort before the MAC is enabled. The high byte of every entry differs from the rev 5 sibling (0x40 vs 0x30): different PAD-gain code prefix for the rev 8 front-end. The low 24 bits coincide with rev 5 across the whole table - the gain step amplitudes are the same, only the PAD-gain selector prefix changes. Values extracted from an MMIO dump of the proprietary Broadcom wl driver running on BCM6362 silicon (wl driver 6.30.102.7). Assisted-by: Claude:claude-4.7-opus Signed-off-by: Alessio Ferri Acked-by: Michael Büsch Reviewed-by: Joshua Peisach Link: https://patch.msgid.link/20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-5-464566194d47@gmail.com Signed-off-by: Johannes Berg

b43: support radio 2057 rev 8

2026-06-10T08:27:53+00:00

Add support for radio 2057 revision 8, paired with N-PHY rev 8 on the Broadcom BCM6362 single-die integrated 2.4 GHz wireless block. Three correlated changes are needed for the same chip: - main.c: the radio_rev allow-list under B43_PHYTYPE_N currently accepts radio 2057 revisions 9 and 14 only; extend to include rev 8. - radio_2057.c: the existing r2057_rev8_init[] is a 54-entry stub declared inside a TODO comment block and never referenced from r2057_upload_inittabs(). Replace it with the full 412-entry register set actually programmed by the proprietary Broadcom wl driver on this radio. I couldn't find the origin of the original 54-entry stub - 8 of its entries do not appear at all in the rev 8 register set and 7 more carry different values. Loading it instead of using the real table leaves the radio hanging producing a "Microcode not responding" timeout. - radio_2057.c: r2057_upload_inittabs() case 8 handles radio_rev 5 and 7 only; add the radio_rev == 8 branch pointing at the new table. The init table is extracted from an MMIO dump of the radio register set programmed during proprietary driver initialisation on BCM6362 silicon (Broadcom wl driver 6.30.102.7). Assisted-by: Claude:claude-4.7-opus Signed-off-by: Alessio Ferri Acked-by: Michael Büsch Reviewed-by: Joshua Peisach Link: https://patch.msgid.link/20260528-b43_complete_n_phy_rev_8_radio_2057_rev_8_support-v4-4-464566194d47@gmail.com Signed-off-by: Johannes Berg