git: 808910385ce9 - stable/15 - mt76: update Mediatek's mt76 driver
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Wed, 22 Apr 2026 21:09:10 UTC
The branch stable/15 has been updated by bz:
URL: https://cgit.FreeBSD.org/src/commit/?id=808910385ce968d1bd056633cc595256e4d1f6f6
commit 808910385ce968d1bd056633cc595256e4d1f6f6
Author: Bjoern A. Zeeb <bz@FreeBSD.org>
AuthorDate: 2026-04-18 21:01:39 +0000
Commit: Bjoern A. Zeeb <bz@FreeBSD.org>
CommitDate: 2026-04-22 20:57:13 +0000
mt76: update Mediatek's mt76 driver
This version is based on
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
028ef9c96e96197026887c0f092424679298aae8 ( tag: v7.0 ).
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 63a40b65c9be74193bb07a76fd66c249bd562eae)
---
sys/contrib/dev/mediatek/mt76/agg-rx.c | 2 +-
sys/contrib/dev/mediatek/mt76/mt7615/mac.c | 2 +-
sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h | 1 +
sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c | 1 +
sys/contrib/dev/mediatek/mt76/mt7925/mac.c | 1 +
sys/contrib/dev/mediatek/mt76/mt7996/mac.c | 1 +
sys/contrib/dev/mediatek/mt76/mt7996/main.c | 2 +-
sys/contrib/dev/mediatek/mt76/mt7996/mcu.c | 2 +-
sys/contrib/dev/mediatek/mt76/scan.c | 4 +---
9 files changed, 9 insertions(+), 7 deletions(-)
diff --git a/sys/contrib/dev/mediatek/mt76/agg-rx.c b/sys/contrib/dev/mediatek/mt76/agg-rx.c
index 3d34caf7e4f7..bf1babac3895 100644
--- a/sys/contrib/dev/mediatek/mt76/agg-rx.c
+++ b/sys/contrib/dev/mediatek/mt76/agg-rx.c
@@ -248,7 +248,7 @@ int mt76_rx_aggr_start(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tidno,
mt76_rx_aggr_stop(dev, wcid, tidno);
- tid = kzalloc(struct_size(tid, reorder_buf, size), GFP_KERNEL);
+ tid = kzalloc_flex(*tid, reorder_buf, size);
if (!tid)
return -ENOMEM;
diff --git a/sys/contrib/dev/mediatek/mt76/mt7615/mac.c b/sys/contrib/dev/mediatek/mt76/mt7615/mac.c
index a4a252dc0186..0ba8a0a6fe8f 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7615/mac.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7615/mac.c
@@ -1058,7 +1058,7 @@ mt7615_mac_queue_rate_update(struct mt7615_phy *phy, struct mt7615_sta *sta,
if (work_pending(&dev->rate_work))
return -EBUSY;
- wrd = kzalloc(sizeof(*wrd), GFP_ATOMIC);
+ wrd = kzalloc_obj(*wrd, GFP_ATOMIC);
if (!wrd)
return -ENOMEM;
diff --git a/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h b/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h
index e16865dd8e52..c93fd245c90f 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h
+++ b/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h
@@ -5,6 +5,7 @@
#define __MT7615_H
#include <linux/completion.h>
+#include <linux/hex.h>
#include <linux/interrupt.h>
#include <linux/ktime.h>
#include <linux/regmap.h>
diff --git a/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c b/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c
index 3304b5971be0..b41ca1410da9 100644
--- a/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c
+++ b/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c
@@ -413,6 +413,7 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
u32 val;
if (ieee80211_is_action(fc) &&
+ skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 + 1 + 2 &&
mgmt->u.action.category == WLAN_CATEGORY_BACK &&
mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {
u16 capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
diff --git a/sys/contrib/dev/mediatek/mt76/mt7925/mac.c b/sys/contrib/dev/mediatek/mt76/mt7925/mac.c
index 1b1a23198b9f..b0a6f42e07a0 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7925/mac.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7925/mac.c
@@ -668,6 +668,7 @@ mt7925_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
u32 val;
if (ieee80211_is_action(fc) &&
+ skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 &&
mgmt->u.action.category == WLAN_CATEGORY_BACK &&
mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ)
tid = MT_TX_ADDBA;
diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/mac.c b/sys/contrib/dev/mediatek/mt76/mt7996/mac.c
index b884f4475021..e74c7b771e97 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7996/mac.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7996/mac.c
@@ -804,6 +804,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
u32 val;
if (ieee80211_is_action(fc) &&
+ skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 &&
mgmt->u.action.category == WLAN_CATEGORY_BACK &&
mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {
if (is_mt7990(&dev->mt76))
diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/main.c b/sys/contrib/dev/mediatek/mt76/mt7996/main.c
index beed795edb24..f16135f0b7f9 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7996/main.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7996/main.c
@@ -966,7 +966,7 @@ mt7996_mac_sta_init_link(struct mt7996_dev *dev,
mtxq->wcid = idx;
}
} else {
- msta_link = kzalloc(sizeof(*msta_link), GFP_KERNEL);
+ msta_link = kzalloc_obj(*msta_link);
if (!msta_link)
return -ENOMEM;
diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c b/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c
index 1e21c05bae28..d6ea60876a14 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c
@@ -745,7 +745,7 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
struct mt7996_wed_rro_session_id *session;
e = (void *)skb->data;
- session = kzalloc(sizeof(*session), GFP_ATOMIC);
+ session = kzalloc_obj(*session, GFP_ATOMIC);
if (!session)
break;
diff --git a/sys/contrib/dev/mediatek/mt76/scan.c b/sys/contrib/dev/mediatek/mt76/scan.c
index ff9176cdee3d..63b0447e55c1 100644
--- a/sys/contrib/dev/mediatek/mt76/scan.c
+++ b/sys/contrib/dev/mediatek/mt76/scan.c
@@ -63,10 +63,8 @@ mt76_scan_send_probe(struct mt76_dev *dev, struct cfg80211_ssid *ssid)
rcu_read_lock();
- if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) {
- ieee80211_free_txskb(phy->hw, skb);
+ if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL))
goto out;
- }
info = IEEE80211_SKB_CB(skb);
if (req->no_cck)