This is based on Linux kernel 6.18.7.
This update contains the following upstream fixes:
f75b9d2c9f5b wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1
401b10a72f5a wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
c0d93d69e147 staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
e841d8ea7223 staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
bf323db1d883 staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
b1497ea24639 wifi: ath10k: move recovery check logic into a new work
99fc0689a588 wifi: ath11k: restore register window after global reset
ab0554f51e5f wifi: ath12k: Fix MSDU buffer types handling in RX error path
d911fa97dab3 wifi: ath12k: fix VHT MCS assignment
ca2a33cee1ef wifi: ath12k: fix TX and RX MCS rate configurations in HE mode
18d4706956b7 wifi: ath11k: fix VHT MCS assignment
6b1a0da75932 wifi: ath11k: fix peer HE MCS assignment
d0a5b5d56438 wifi: ath12k: restore register window after global reset
1564c04afa92 wifi: iwlwifi: mld: add null check for kzalloc() in iwl_mld_send_proto_offload()
d0bb3db7b295 wifi: ath12k: fix potential memory leak in ath12k_wow_arp_ns_offload()
36faecac7a2c wifi: ath12k: fix reusing m3 memory
4f93750fa588 wifi: ath12k: fix error handling in creating hardware group
41b623129175 wifi: ath12k: enforce vdev limit in ath12k_mac_vdev_create()
e442e820e953 wifi: ath12k: unassign arvif on scan vdev create failure
bcf44fe565bf wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler()
87cc6fe79c3e wifi: rtw89: usb: fix leak in rtw89_usb_write_port()
c7ca777c5879 wifi: ath12k: Fix timeout error during beacon stats retrieval
51b823d7723f wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()
c9d1c4152e6d wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
a6fb8785b179 wifi: mac80211: fix CMAC functions not handling errors
5ebf0fe7eaef wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()
b8f34c1c5c4f wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()
cbeca0b7ea20 wifi: mt76: mt7996: Remove unnecessary link_id checks in mt7996_tx
d582d0e988d6 wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks
d2d11298dfc3 wifi: mt76: mt7996: Remove useless check in mt7996_msdu_page_get_from_cache()
2cde732373a7 Revert "wifi: mt76: mt792x: improve monitor interface handling"
74bb080717a3 wifi: mt76: mt7996: fix max nss value when getting rx chainmask
95bb36f8d6b3 wifi: mt76: mt7996: fix implicit beamforming support for mt7992
ee94375d06b5 wifi: mt76: mt7996: fix several fields in mt7996_mcu_bss_basic_tlv()
d64e6f27260e wifi: mt76: mt7996: fix teardown command for an MLD peer
e5c42efeb162 wifi: mt76: mt7996: set link_valid field when initializing wcid
9a43ed9ab800 wifi: mt76: mt7996: fix MLD group index assignment
7d6cd8f51ad8 wifi: mt76: mt7996: fix MLO set key and group key issues
1a4b481a21ae wifi: mt76: mt7996: fix using wrong phy to start in mt7996_mac_restart()
b4b789d24319 wifi: mt76: mt7996: fix EMI rings for RRO
46f0648e261c wifi: mt76: mt7996: grab mt76 mutex in mt7996_mac_sta_event()
70656b45467c wifi: mt76: Move mt76_abort_scan out of mt76_reset_device()
c319967690d4 wifi: mt76: mt7996: skip deflink accounting for offchannel links
abdedd46dc58 wifi: mt76: mt7996: skip ieee80211_iter_keys() on scanning link remove
f4c57afff3b0 wifi: mt76: mt7996: Add missing locking in mt7996_mac_sta_rc_work()
4d42aba0ee49 mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
ad26a7ef0488 wifi: ieee80211: correct FILS status codes
40257a2ef1bc wifi: rtl8xxxu: Fix HT40 channel config for RTL8192CU, RTL8723AU
c3ab9657866f wifi: cfg80211: stop radar detection in cfg80211_leave()
0283fac52b42 wifi: cfg80211: use cfg80211_leave() in iftype change
9c6f9b2a80ed wifi: mt76: mt792x: fix wifi init fail by setting MCU_RUNNING after CLC load
f5323b43019d wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet
498e286941b9 wifi: mt76: Fix DTS power-limits on little endian systems
e5c129a05531 wifi: rtw88: limit indirect IO under powered off for RTL8822CS
90a15ff32464 wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
7ea38152a289 wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
182a2786d248 wifi: mac80211: do not use old MBSSID elements
de5eb6b65e9f wifi: iwlwifi: Fix firmware version handling
a21704df4024 wifi: mac80211: Discard Beacon frames to non-broadcast address
e3c35177103e wifi: avoid kernel-infoleak from struct iw_point
b97be67dc06e wifi: mac80211: restore non-chanctx injection behaviour
1251bbdb8f5b wifi: mac80211_hwsim: fix typo in frequency notification
The following patches were applied upstream:
build/130-backports-move-__counted_by-to-compiler_types.h-head.patch patch [1]
build/999-kernel-6.12.64.patch [2]
[1]: https://github.com/openwrt/backports/commit/
b63f79524e6f30e58692bc9ee57c6e6e0dd10de4
[2]: https://github.com/openwrt/backports/commit/
ed8c176dfab1ae8962435576face472aaa7294c3
Link: https://github.com/openwrt/openwrt/pull/21711
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
PKG_NAME:=mac80211
-PKG_VERSION:=6.18
+PKG_VERSION:=6.18.7
PKG_RELEASE:=1
PKG_LICENSE:=GPL-2.0-only
PKG_LICENSE_FILES:=COPYING
PKG_SOURCE_URL:=https://github.com/openwrt/backports/releases/download/backports-v$(PKG_VERSION)
-PKG_HASH:=3bd5d84b1e56cf8addff0d1e4bcf06753c51feee88c4d7925fb7b67784529436
+PKG_HASH:=623e5cf46ca8e81fd413f4f465e2580a0143e24929f9c22ce1ba7c34f2872989
PKG_SOURCE:=backports-$(PKG_VERSION).tar.zst
PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(if $(BUILD_VARIANT),$(PKG_NAME)-$(BUILD_VARIANT)/)backports-$(PKG_VERSION)
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3586,6 +3586,16 @@ int ath10k_core_register(struct ath10k *
+@@ -3583,6 +3583,16 @@ int ath10k_core_register(struct ath10k *
queue_work(ar->workqueue, &ar->register_work);
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -1052,6 +1052,40 @@ static inline int ath10k_vdev_delete_syn
+@@ -1051,6 +1051,40 @@ static inline int ath10k_vdev_delete_syn
return 0;
}
static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
{
struct cfg80211_chan_def *chandef = NULL;
-@@ -1084,7 +1118,8 @@ static int ath10k_monitor_vdev_start(str
+@@ -1083,7 +1117,8 @@ static int ath10k_monitor_vdev_start(str
arg.channel.min_power = 0;
arg.channel.max_power = channel->max_power * 2;
arg.channel.max_reg_power = channel->max_reg_power * 2;
reinit_completion(&ar->vdev_setup_done);
reinit_completion(&ar->vdev_delete_done);
-@@ -1530,7 +1565,8 @@ static int ath10k_vdev_start_restart(str
+@@ -1529,7 +1564,8 @@ static int ath10k_vdev_start_restart(str
arg.channel.min_power = 0;
arg.channel.max_power = chandef->chan->max_power * 2;
arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
arg.ssid = arvif->u.ap.ssid;
-@@ -3461,7 +3497,8 @@ static int ath10k_update_channel_list(st
+@@ -3460,7 +3496,8 @@ static int ath10k_update_channel_list(st
ch->min_power = 0;
ch->max_power = channel->max_power * 2;
ch->max_reg_power = channel->max_reg_power * 2;
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -11,6 +11,7 @@
+@@ -10,6 +10,7 @@
#include <linux/module.h>
#include <linux/firmware.h>
#include <linux/of.h>
#include <linux/property.h>
#include <linux/dmi.h>
#include <linux/ctype.h>
-@@ -3458,6 +3459,8 @@ static int ath10k_core_probe_fw(struct a
+@@ -3455,6 +3456,8 @@ static int ath10k_core_probe_fw(struct a
device_get_mac_address(ar->dev, ar->mac_addr);
int ath11k_mhi_register(struct ath11k_pci *ar_pci);
--- a/drivers/net/wireless/ath/ath11k/pci.c
+++ b/drivers/net/wireless/ath/ath11k/pci.c
-@@ -376,13 +376,20 @@ static void ath11k_pci_sw_reset(struct a
+@@ -394,13 +394,20 @@ static void ath11k_pci_sw_reset(struct a
static void ath11k_pci_init_qmi_ce_config(struct ath11k_base *ab)
{
struct ath11k_qmi_ce_cfg *cfg = &ab->qmi.ce_cfg;
struct ath11k_targ_cap target_caps;
--- a/drivers/net/wireless/ath/ath11k/pci.c
+++ b/drivers/net/wireless/ath/ath11k/pci.c
-@@ -391,6 +391,8 @@ static void ath11k_pci_init_qmi_ce_confi
+@@ -409,6 +409,8 @@ static void ath11k_pci_init_qmi_ce_confi
} else
ab->qmi.service_ins_id = ab->hw_params.qmi_service_ins_id;
--- a/drivers/net/wireless/ath/ath12k/pci.c
+++ b/drivers/net/wireless/ath/ath12k/pci.c
-@@ -279,6 +279,9 @@ static void ath12k_pci_enable_ltssm(stru
+@@ -297,6 +297,9 @@ static void ath12k_pci_enable_ltssm(stru
u32 val;
int i;
--- a/drivers/net/wireless/ath/ath12k/wmi.c
+++ b/drivers/net/wireless/ath/ath12k/wmi.c
-@@ -2891,6 +2891,9 @@ int ath12k_wmi_send_scan_chan_list_cmd(s
+@@ -2894,6 +2894,9 @@ int ath12k_wmi_send_scan_chan_list_cmd(s
max_chan_limit = (wmi->wmi_ab->max_msg_len[ar->pdev_idx] - len) /
sizeof(*chan_info);
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
-@@ -7723,9 +7723,7 @@ static void ath12k_mac_setup_ht_vht_cap(
+@@ -7724,9 +7724,7 @@ static void ath12k_mac_setup_ht_vht_cap(
rate_cap_rx_chainmask);
}
struct ath12k_ce_ring *status_ring;
--- a/drivers/net/wireless/ath/ath12k/pci.c
+++ b/drivers/net/wireless/ath/ath12k/pci.c
-@@ -430,9 +430,9 @@ static void ath12k_pci_sync_ce_irqs(stru
+@@ -448,9 +448,9 @@ static void ath12k_pci_sync_ce_irqs(stru
}
}
int irq_idx = ATH12K_PCI_IRQ_CE0_OFFSET + ce_pipe->pipe_num;
ath12k_ce_per_engine_service(ce_pipe->ab, ce_pipe->pipe_num);
-@@ -454,7 +454,7 @@ static irqreturn_t ath12k_pci_ce_interru
+@@ -472,7 +472,7 @@ static irqreturn_t ath12k_pci_ce_interru
disable_irq_nosync(ab->irq_num[irq_idx]);
return IRQ_HANDLED;
}
-@@ -684,7 +684,7 @@ static int ath12k_pci_config_irq(struct
+@@ -702,7 +702,7 @@ static int ath12k_pci_config_irq(struct
irq_idx = ATH12K_PCI_IRQ_CE0_OFFSET + i;
ret = request_irq(irq, ath12k_pci_ce_interrupt_handler,
ab_pci->irq_flags, irq_name[irq_idx],
-@@ -967,7 +967,7 @@ static void ath12k_pci_aspm_restore(stru
+@@ -985,7 +985,7 @@ static void ath12k_pci_aspm_restore(stru
PCI_EXP_LNKCTL_ASPMC);
}
{
int i;
-@@ -977,7 +977,7 @@ static void ath12k_pci_cancel_workqueue(
+@@ -995,7 +995,7 @@ static void ath12k_pci_cancel_workqueue(
if (ath12k_ce_get_attr_flags(ab, i) & CE_ATTR_DIS_INTR)
continue;
}
}
-@@ -985,7 +985,7 @@ static void ath12k_pci_ce_irq_disable_sy
+@@ -1003,7 +1003,7 @@ static void ath12k_pci_ce_irq_disable_sy
{
ath12k_pci_ce_irqs_disable(ab);
ath12k_pci_sync_ce_irqs(ab);
+++ /dev/null
-From b63f79524e6f30e58692bc9ee57c6e6e0dd10de4 Mon Sep 17 00:00:00 2001
-From: Christian Marangi <ansuelsmth@gmail.com>
-Date: Wed, 10 Dec 2025 22:37:03 +0100
-Subject: [PATCH] backports: move __counted_by to compiler_types.h header
-
-Port f06e108a3dc5 ("Compiler Attributes: disable __counted_by for clang
-< 19.1.3") changes to align with new kernel version that moved the
-__counted_by to a new header file.
-
-Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
----
- .../linux/compiler_attributes.h | 15 ------------
- .../backport-include/linux/compiler_types.h | 23 +++++++++++++++++++
- 2 files changed, 23 insertions(+), 15 deletions(-)
- create mode 100644 backport-include/linux/compiler_types.h
-
---- a/backport-include/linux/compiler_attributes.h
-+++ b/backport-include/linux/compiler_attributes.h
-@@ -31,19 +31,4 @@
- #endif
- #endif /* fallthrough */
-
--#ifndef __counted_by
--/*
-- * Optional: only supported since gcc >= 14
-- * Optional: only supported since clang >= 17
-- *
-- * gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896
-- * clang: https://reviews.llvm.org/D148381
-- */
--#if __has_attribute(__element_count__)
--# define __counted_by(member) __attribute__((__element_count__(#member)))
--#else
--# define __counted_by(member)
--#endif
--#endif
--
- #endif /* _BACKPORTS_LINUX_COMPILER_ATTRIBUTES_H */
---- /dev/null
-+++ b/backport-include/linux/compiler_types.h
-@@ -0,0 +1,23 @@
-+#ifndef _BACKPORTS_LINUX_COMPILER_TYPES_H
-+#define _BACKPORTS_LINUX_COMPILER_TYPES_H 1
-+
-+#if LINUX_VERSION_IS_GEQ(6,12,1)
-+#include_next <linux/compiler_types.h>
-+#endif
-+
-+#ifndef __counted_by
-+/*
-+ * Optional: only supported since gcc >= 14
-+ * Optional: only supported since clang >= 17
-+ *
-+ * gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896
-+ * clang: https://reviews.llvm.org/D148381
-+ */
-+#if __has_attribute(__element_count__)
-+# define __counted_by(member) __attribute__((__element_count__(#member)))
-+#else
-+# define __counted_by(member)
-+#endif
-+#endif
-+
-+#endif /* _BACKPORTS_LINUX_COMPILER_TYPES_H */
}
return err;
-@@ -1549,7 +1565,11 @@ static int cfg80211_netdev_notifier_call
+@@ -1550,7 +1566,11 @@ static int cfg80211_netdev_notifier_call
SET_NETDEV_DEVTYPE(dev, &wiphy_type);
wdev->netdev = dev;
/* can only change netns with wiphy */
+++ /dev/null
-diff --git a/backport-include/linux/hrtimer.h b/backport-include/linux/hrtimer.h
-index 3c351922c81d..d865dbf42e9b 100644
---- a/backport-include/linux/hrtimer.h
-+++ b/backport-include/linux/hrtimer.h
-@@ -17,12 +17,14 @@ static inline enum hrtimer_restart hrtimer_dummy_timeout(struct hrtimer *unused)
- return HRTIMER_NORESTART;
- }
-
-+#if LINUX_VERSION_IS_LESS(6,12,64)
- static inline void
- hrtimer_update_function(struct hrtimer *timer,
- enum hrtimer_restart (*function)(struct hrtimer *))
- {
- timer->function = function;
- }
-+#endif /* < 6.12.64 */
-
- static inline void
- hrtimer_setup(struct hrtimer *timer, enum hrtimer_restart (*function)(struct hrtimer *),
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
-@@ -1882,12 +1882,6 @@ static int ieee80211_stop_ap(struct wiph
+@@ -1872,12 +1872,6 @@ static int ieee80211_stop_ap(struct wiph
__sta_info_flush(sdata, true, link_id, NULL);
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
-@@ -3131,6 +3131,8 @@ static int ieee80211_scan(struct wiphy *
+@@ -3121,6 +3121,8 @@ static int ieee80211_scan(struct wiphy *
*/
fallthrough;
case NL80211_IFTYPE_AP:
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
-@@ -4084,7 +4084,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4086,7 +4086,7 @@ struct ieee80211_txq *ieee80211_next_txq
if (deficit < 0)
sta->airtime[txqi->txq.ac].deficit +=
if (deficit < 0 || !aql_check) {
list_move_tail(&txqi->schedule_order,
-@@ -4229,7 +4229,8 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4231,7 +4231,8 @@ bool ieee80211_txq_may_transmit(struct i
}
sta = container_of(iter->txq.sta, struct sta_info, sta);
if (ieee80211_sta_deficit(sta, ac) < 0)
list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
}
-@@ -4237,7 +4238,7 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4239,7 +4240,7 @@ bool ieee80211_txq_may_transmit(struct i
if (sta->airtime[ac].deficit >= 0)
goto out;
atomic_add(tx_airtime,
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
-@@ -2554,7 +2554,7 @@ static u16 ieee80211_store_ack_skb(struc
+@@ -2556,7 +2556,7 @@ static u16 ieee80211_store_ack_skb(struc
spin_lock_irqsave(&local->ack_status_lock, flags);
id = idr_alloc(&local->ack_status_frames, ack_skb,
spin_unlock_irqrestore(&local->ack_status_lock, flags);
if (id >= 0) {
-@@ -3985,20 +3985,20 @@ begin:
+@@ -3987,20 +3987,20 @@ begin:
encap_out:
info->control.vif = vif;
}
return skb;
-@@ -4050,6 +4050,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4052,6 +4052,7 @@ struct ieee80211_txq *ieee80211_next_txq
struct ieee80211_txq *ret = NULL;
struct txq_info *txqi = NULL, *head = NULL;
bool found_eligible_txq = false;
spin_lock_bh(&local->active_txq_lock[ac]);
-@@ -4073,26 +4074,26 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4075,26 +4076,26 @@ struct ieee80211_txq *ieee80211_next_txq
if (!head)
head = txqi;
if (txqi->schedule_round == local->schedule_round[ac])
goto out;
-@@ -4159,7 +4160,8 @@ bool ieee80211_txq_airtime_check(struct
+@@ -4161,7 +4162,8 @@ bool ieee80211_txq_airtime_check(struct
return true;
if (!txq->sta)
if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
return true;
-@@ -4208,15 +4210,15 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4210,15 +4212,15 @@ bool ieee80211_txq_may_transmit(struct i
spin_lock_bh(&local->active_txq_lock[ac]);
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
-@@ -3825,6 +3825,27 @@ static bool ieee80211_is_scan_ongoing(st
+@@ -3815,6 +3815,27 @@ static bool ieee80211_is_scan_ongoing(st
return false;
}
static int ieee80211_start_radar_detection(struct wiphy *wiphy,
struct net_device *dev,
struct cfg80211_chan_def *chandef,
-@@ -3838,7 +3859,7 @@ static int ieee80211_start_radar_detecti
+@@ -3828,7 +3849,7 @@ static int ieee80211_start_radar_detecti
lockdep_assert_wiphy(local->hw.wiphy);
return -EBUSY;
link_data = sdata_dereference(sdata->link[link_id], sdata);
-@@ -4330,7 +4351,7 @@ __ieee80211_channel_switch(struct wiphy
+@@ -4320,7 +4341,7 @@ __ieee80211_channel_switch(struct wiphy
lockdep_assert_wiphy(local->hw.wiphy);
* the suspend->resume cycle. Since we can't check each caller
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
-@@ -2964,6 +2964,9 @@ bool cfg80211_radio_chandef_valid(const
+@@ -2943,6 +2943,9 @@ bool cfg80211_radio_chandef_valid(const
{
u32 freq, width;
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
-@@ -4594,7 +4594,9 @@ static int ieee80211_probe_client(struct
+@@ -4584,7 +4584,9 @@ static int ieee80211_probe_client(struct
struct ieee80211_tx_info *info;
struct sta_info *sta;
struct ieee80211_chanctx_conf *chanctx_conf;
int ret;
/* the lock is needed to assign the cookie later */
-@@ -4609,7 +4611,23 @@ static int ieee80211_probe_client(struct
+@@ -4599,7 +4601,23 @@ static int ieee80211_probe_client(struct
qos = sta->sta.wme;
if (WARN_ON(!chanctx_conf)) {
ret = -EINVAL;
goto unlock;
-@@ -4641,14 +4659,15 @@ static int ieee80211_probe_client(struct
+@@ -4631,14 +4649,15 @@ static int ieee80211_probe_client(struct
nullfunc->frame_control = fc;
nullfunc->duration_id = 0;
memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
projects / thirdparty / openwrt.git / commitdiff
