kernel/git/next/linux-next.git/drivers/net/wireless/virtual, branch master

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git

2026-09-17T15:03:59+00:00

# Conflicts: # drivers/net/wireless/virtual/mac80211_hwsim_main.c # include/net/mac80211.h # net/mac80211/iface.c # net/mac80211/tx.c

wifi: mac80211: change public RX API to use link stations

2026-09-16T08:42:39+00:00

If a station is passed then the link ID also needs to be known. As such, it is a more natural API to simply pass the link station directly rather than pushing the link information into the RX status. Furthermore, having the link ID in the RX status is not actually correct because the link IDs are VIF specific and there may be multiple VIFs. In the case of a station this relationship is clear, but then one may as well use the link station. This patch only changes the API and emulates the old (incorrect) behaviour for now. The mac80211 RX code will be updated in later patches. Signed-off-by: Benjamin Berg Link: https://patch.msgid.link/20260915151925.06f41565116a.I4a2d45609e94b52654b10ec572e59a45d09c41f4@changeid Signed-off-by: Johannes Berg

wifi: mac80211_hwsim: overwrite report SKB

2026-09-14T13:47:39+00:00

In a new test framework for hwsim I'm working on, tests can modify the frame as it passes through the wmediumd APIs. If then the original frame is reported on the monitor interface, things get a bit confusing. Overwrite the frame that will be reported to the monitor with the frame reported for RX if both transmitter and cookie attributes are present (wmediumd doesn't set them). Also add a HWSIM_ATTR_NO_MONITOR flag to allow a frame to be dropped entirely from monitor report, e.g. in case it was never delivered to any peer. Link: https://patch.msgid.link/20260911154632.c06da6d18055.Iaba24acec4c5765fbad77376418b17d1b863791b@changeid Signed-off-by: Johannes Berg

wifi: mac80211_hwsim: fix potential channel crash

2026-09-14T13:47:38+00:00

If wmediumd is used together with a hwsim radio that has channel contexts enabled, the channel pointer can be NULL. Track the frequency so we don't need it at that point, avoiding the crash but still reporting the right freq. Link: https://patch.msgid.link/20260911154632.44cf5d8492c2.I9448bd3cea76eb90554ae73fc77e0a3092ff1271@changeid Signed-off-by: Johannes Berg

wifi: mac80211_hwsim: send config events to the radio's net namespace

2026-09-14T12:54:12+00:00

hwsim_mcast_config_msg() falls back to genlmsg_multicast() when it has no genl_info, and that only reaches init_net. A radio in another namespace therefore has its DEL_RADIO announced in init_net, while its own namespace hears nothing. Multicast to wiphy_net() instead, the net that GET and DUMP already filter on. Tested with a config-group listener in each namespace, on a base and a patched kernel. Assisted-by: Claude:claude-opus-5 codeql Signed-off-by: Maoyi Xie Link: https://patch.msgid.link/20260904140300.3402053-1-maoyixie.tju@gmail.com Signed-off-by: Johannes Berg

wifi: virt_wifi: don't transfer operstate before register

2026-09-14T12:48:01+00:00

virt_wifi_newlink() calls netif_stacked_transfer_operstate() before register_netdevice(). If the lower device is dormant, that queues the new netdev on lweventlist while it is still uninitialized. If registration fails after that, for example because of an invalid name such as "bad/name", free_netdev() immediately frees the object. A later linkwatch_fire_event() then use-after-frees the list entry. Move the transfer to after netdev_upper_dev_link(), as macvlan and ipvlan already do. Fixes: c7cdba31ed8b ("mac80211-next: rtnetlink wifi simulation device") Reported-by: Vega Assisted-by: LLM Co-developed-by: Luxing Yin Signed-off-by: Luxing Yin Signed-off-by: Zihan Xi Link: https://patch.msgid.link/f5a832fb0ab228ce6e2b5a91fba4ca8b79198a2f.1788948455.git.zihanx@nebusec.ai Signed-off-by: Johannes Berg

wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping

2026-09-09T12:51:29+00:00

The code checks ->started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit the WARN_ON(!local->started). Expand the mutex for this case and synchronise against it when the radio is stopped to avoid being able to hit the warning with hwsim. Drop the error print that would've complicated the error path, it only triggers for allocation failures (already noisy) and malformed frames anyway. Assisted-by: LLM Fixes: 7882513bacb1 ("mac80211_hwsim driver support userspace frame tx/rx") Reported-by: syzbot+b4aa2b672b18f1d4dc5f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b4aa2b672b18f1d4dc5f Link: https://patch.msgid.link/20260904170140.5f69a10d606b.I4a7921d00643f69e439c7a3b221d104f66a3dcdc@changeid Signed-off-by: Johannes Berg

wifi: virt_wifi: free skb when disconnected

2026-09-04T08:08:00+00:00

When the simulated link is disconnected, virt_wifi_start_xmit() returns NET_XMIT_DROP without freeing the skb. dev_hard_start_xmit() treats this return value as consumed, so every packet sent while disconnected leaks its skb. Free the skb before returning the drop status. Fixes: c7cdba31ed8b ("mac80211-next: rtnetlink wifi simulation device") Signed-off-by: Mariano Baragiola Link: https://patch.msgid.link/20260809124947.3590270-1-mbaragiola@linux.com Signed-off-by: Johannes Berg

Merge tag 'wireless-2026-07-26' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next

2026-07-27T23:03:40+00:00

Johannes Berg says: ==================== wireless-next-2026-07-26 Mostly driver changes this time: - new driver mm81x for an S1G device - new driver nxpwifi for NXP devices (mostly forked off from mwifiex) - ath12k: much kernel infrastructure integration work - brcmfmac: DPP support, some Cypress part update - nl80211: per-link statistics support ==================== Link: https://patch.msgid.link/20260726105205.942922-60-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski

wifi: mac80211_hwsim: report TX status link_id

2026-07-22T13:52:51+00:00

Populate link_valid/link_id in mac80211_hwsim TX status so the transmitted link is reported to mac80211. Set the link information in both the direct TX status path and the wmediumd/netlink TX status path. With that done, enable NL80211_EXT_FEATURE_PROBE_AP. Signed-off-by: Priyansha Tiwari Link: https://patch.msgid.link/20260709114228.672317-3-pritiwa@qti.qualcomm.com [add note about NL80211_EXT_FEATURE_PROBE_AP] Signed-off-by: Johannes Berg