kernel/git/stable/linux.git/drivers/net/wireless/nxp, branch master

wifi: nxpwifi: bound uAP association event IEs to the event buffer

2026-08-06T12:04:51+00:00

nxpwifi_uap_event_sta_assoc() exposes the association request IEs that the firmware reports in the uAP association event, which the driver copies into the fixed-size event_body[] buffer. event->len is supplied by firmware and is not validated. A value smaller than the header underflows the subtraction used for assoc_req_ies_len, while a larger value can make the IE range extend beyond event_body[]. Subsequent IE parsing can then read past the adapter object. Validate both bounds before using the firmware-reported length. nxpwifi was derived from mwifiex before commit f0858bfc7d3c ("wifi: mwifiex: bound uAP association event IEs to the event buffer") and retains the same unchecked length. Apply the equivalent bounds check here. Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Signed-off-by: Linmao Li Reviewed-by: Jeff Chen Link: https://patch.msgid.link/20260729082457.1897303-1-lilinmao@kylinos.cn Signed-off-by: Johannes Berg

wifi: nxpwifi: detach sync command buffer on interrupted wait

2026-08-06T12:04:42+00:00

nxpwifi synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there, for example nxpwifi_get_chan_type() and the timeshare_coex debugfs handlers. If wait_event_interruptible_timeout() is interrupted or times out, the caller can return and release that stack object while the command is still current. nxpwifi_cancel_all_pending_cmd() deliberately keeps the current command because a response may still arrive. A late firmware response can then write through cmd_node->data_buf into the stale stack address. After cancelling pending commands, detach the caller-owned buffer from the still-current command under nxpwifi_cmd_lock. Unlike the host command response path, several command response callbacks do not tolerate a NULL data buffer. Most of them ignore it or check it already, but nxpwifi_ret_sta_get_chan_info(), nxpwifi_ret_sta_hs_wakeup_reason() and nxpwifi_ret_sta_robust_coex() dereference it unconditionally, so let them discard a detached response. No caller passes a NULL buffer to these commands today, so this only affects the newly introduced detached state. nxpwifi was derived from mwifiex before commit ef06882c7d8a ("wifi: mwifiex: Detach sync cmd buffer on interrupted wait") and retains the same lifetime bug. Apply the equivalent buffer detachment here. Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Signed-off-by: Linmao Li Link: https://patch.msgid.link/20260729124713.2849018-1-lilinmao@kylinos.cn Signed-off-by: Johannes Berg

wifi: nxpwifi: fix multiple static analysis errors and warnings

2026-08-06T12:03:15+00:00

Fix various development-phase bugs, code quality, and logical issues reported by the kernel test robot (using the Smatch static analysis tool). The following addressable fixes are included: - 11n.c & 11ax.c: Fix potential NULL pointer dereferences by correcting logical operators (&& to ||) in 11n.c and hoisting the bss_desc verification to the top of the function in 11ax.c. - 11n.c: Fix a severe Use-After-Free (UAF) memory corruption during RCU list traversal. Restore the proper list_for_each_entry_safe() loop structure along with the required array index [i] within the locked writer path. - sdio.c: Fix a missing unwind resource cleanup pathway where a protocol error branch returned directly via -EINVAL instead of using 'goto term_cmd', leaving the SDIO hardware state machine out of sync. - main.h: Fix a signedness mismatch bug where nxpwifi_get_unused_bss_num() could return -2 as an unsigned integer fallback. - util.c: Remove a redundant and dead condition check (position <= 15) which was always true for a 4-bit unsigned bit-field member variable. - cfg80211.c: Clean up a dead unreachable 'return 0' at the bottom of the switch-case logic. - uap_txrx.c: Clean up mismatched and inconsistent indentations within the handling of multicast RX forward paths. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202608020855.QwN5n7i5-lkp@intel.com/ Assisted-by: Gemini:unknown-model Signed-off-by: Jeff Chen Link: https://patch.msgid.link/20260803162741.438820-1-chunfan.chen@gmail.com Signed-off-by: Johannes Berg

wifi: nxp: NXPWIFI should be invisible and selected by its users

2026-08-06T12:00:47+00:00

All supported NXP WiFi wireless adapters have an SDIO interface. Hence there is no point in asking the user about these adapters when configuring a kernel without MMC support. Fix this by making the core driver symbol invisible, and selecting it by its user when needed. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/aefb37d8398175cb2fb520cb5f725a85bcd3049d.1786010763.git.geert+renesas@glider.be Signed-off-by: Johannes Berg

wifi: nxpwifi: embed rx_reorder_ptr

2026-08-02T15:45:35+00:00

rx_reorder_ptr is a dynamically allocated array which is done near the main struct allocation. Combine the two to avoid freeing separately. Also fix the type to what it actually is. void is normally used to avoid casting but there's no need here. Signed-off-by: Rosen Penev Tested-by: Jeff Chen Reviewed-by: Jeff Chen Link: https://patch.msgid.link/20260729183715.691287-1-rosenp@gmail.com Signed-off-by: Johannes Berg

wifi: cfg80211: convert cookie output to input parameter

2026-08-02T15:40:08+00:00

The remain_on_channel, mgmt_tx, and probe_peer ops previously used a u64 *cookie output parameter. Now that cfg80211 pre-assigns the cookie value before invoking drivers, the parameter conveys a value from caller to driver, not the other way around. Convert it to a plain u64 input parameter across the ops struct (cfg80211.h), rdev-ops.h wrappers, nl80211.c/mlme.c call sites, mac80211, and all driver implementations. The tx_control_port op is excluded: its cookie pointer is nullable (passed as NULL when dont_wait_for_ack is set), so the nullable pointer semantics are still required. Internal mac80211 helpers ieee80211_start_roc_work() and ieee80211_attach_ack_skb() still take u64 *cookie because they assign to the pointee; their callers now pass &cookie to take the address of the local value parameter. wil6210's internal wil_p2p_listen() is also updated to take u64 cookie since it is called directly from the remain_on_channel callback. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20260731123509.1975281-12-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg

wifi: nxpwifi: use pre-assigned cookie for remain_on_channel and mgmt_tx

2026-08-02T15:40:07+00:00

Stop calling nxpwifi_roc_cookie() to generate cookies in nxpwifi_cfg80211_remain_on_channel() and nxpwifi_cfg80211_mgmt_tx(). Use the pre-assigned cookie from cfg80211 instead. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Arend van Spriel Link: https://patch.msgid.link/20260731123509.1975281-9-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg

wifi: nxpwifi: reject zero-length extension elements in beacon IEs

2026-07-28T14:00:40+00:00

nxpwifi_update_bss_desc_with_ie() dispatches on elem->data[0] for WLAN_EID_EXTENSION without checking that the element has a payload. A well-formed extension element carries at least the element ID extension byte, but nothing enforces that in the IE stream, and the loop accepts a zero-length element because its header alone fits. elem->data[0] then reads the byte after the element, which is past the kmemdup()ed IE buffer when that element ends the stream. Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Signed-off-by: Linmao Li Link: https://patch.msgid.link/20260724103656.2494129-1-lilinmao@kylinos.cn Signed-off-by: Johannes Berg

wifi: nxp: add nxpwifi driver for IW61x

2026-07-15T12:52:52+00:00

Add support for the NXP IW61x wireless devices. The nxpwifi driver implements a full-MAC design and integrates with cfg80211 for configuration and control, supporting both station (STA) and access point (AP) modes. The driver provides a firmware-based command/event interface using TLV messages, with the core handling command processing, event dispatching, and device lifecycle management. A SDIO transport layer is implemented to support IW61x devices. Key features include: - 802.11n/ac/ax (HT/VHT/HE) capability support - Scan, association, and connection management - Data path handling for TX/RX, including aggregation and reorder - WMM QoS support and traffic prioritization - 802.11h (DFS/TPC) support for regulatory compliance - cfg80211 integration for STA and AP operations - Debugfs and ethtool support - Wake-on-LAN support The driver translates cfg80211 configuration into firmware commands and implements required data path processing in software where needed. Signed-off-by: Jeff Chen