From nobody Wed Apr 22 21:09:10 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g1Bfv3tBnz6bL4g for ; Wed, 22 Apr 2026 21:09:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4g1Bfv0Yjsz3m8N for ; Wed, 22 Apr 2026 21:09:11 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1776892151; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yr0jxbgKZTeQOMQqMxox5qXIoSCq3ddI6srnVRd0fJk=; b=qspl4SbiqI4aBPIpDAvh7Fx3ImUiMWQDMUt7TeZX1NiK87DCn48DSjmaOx7IlYeW+scqvy +4fJ0EhULsIEDB5o3DxqcDKWqNaC/8AnmBtBahOjkucZNlHtjXvLrDXLlxQeeyDDBoIThJ O/5xIgQS7/bQSEwxf0UAuURIO86lLoVJ/DOFflQvwHvn/NNK6bRBqz8vjiDBXvuaCu7uAb 6W+b4TP6b9JpVVLh7QLBjrJgQX987Lg+BpblYEu3XeGEOkmkkkqUezUIGjHtdGudHHccn8 fndvVRYkiHGqpl6K6u7+f8eOXO2eSABKuFYI6AHdsflf9ib2DfNdnyd+8l2a6A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1776892151; a=rsa-sha256; cv=none; b=mCc/HSc9HTyXeE6hGImLs0FsAZhjFwKzJVsPH/KaeXoixFLG0nlDHe8vSYv8sfkOM1AdM3 N0D7VulLY1EYeG1v14TqdDjrY4mJ+JQ/AgYumzHU46xZPcnbCvMlwFHgDtTW7XvQRv0sCO B+FxRFcGybPXZ8LQTFfE4iLG2WSiTuD6RHlLt+JXgZZf4FL3eG5Wlx+HBQZW7hgR7FoJJM fLm+KIRzN121b/OwFR6lV8wezGu5lfkMopA2QOuPgrqoE9+YDiOv5mWzi7GOHwNUrALRpz uKZVs+1xqkIpexuXF7jikQo4NPjnYIe0nLx1FXX6KEY8OyZLo/+UcPpNaP5MIA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1776892151; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yr0jxbgKZTeQOMQqMxox5qXIoSCq3ddI6srnVRd0fJk=; b=aaxMk+OuUFwak4nslDCa9LzCWROxWYPsnoDanO3oDLkJMpRk/DlqZD6NgRq2xepnkjp49e 80TJL4TMoc52vCbCwOU2o8NiYl1/aCaCypNkG+oUSLMcwtCK8K5JsygPGIrOzawcR1UenV Ec/1DDDH41+eIWS8IOcMwJKKwsuQ/9E3daiRXdHlKABzAVk0o7XNhA3/bHLid0aZfhOiKn MLyUYAByJDrTb37GxAoY+ZWvbl5vlvh0aYm63AgW1wFC1kX6bwDzJU07mYZC13Og/STUq2 snkCsBZwz+s+gc0PJyWiFusC0uvaU8XWY6joHDyyh3IyXYWalnDsmjZOwafG5g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4g1Bfv00kgzncl for ; Wed, 22 Apr 2026 21:09:11 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 30a2d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 22 Apr 2026 21:09:10 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Bjoern A. Zeeb Subject: git: 808910385ce9 - stable/15 - mt76: update Mediatek's mt76 driver List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: bz X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 808910385ce968d1bd056633cc595256e4d1f6f6 Auto-Submitted: auto-generated Date: Wed, 22 Apr 2026 21:09:10 +0000 Message-Id: <69e938f6.30a2d.19a6264e@gitrepo.freebsd.org> The branch stable/15 has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=808910385ce968d1bd056633cc595256e4d1f6f6 commit 808910385ce968d1bd056633cc595256e4d1f6f6 Author: Bjoern A. Zeeb AuthorDate: 2026-04-18 21:01:39 +0000 Commit: Bjoern A. Zeeb CommitDate: 2026-04-22 20:57:13 +0000 mt76: update Mediatek's mt76 driver This version is based on git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 028ef9c96e96197026887c0f092424679298aae8 ( tag: v7.0 ). Sponsored by: The FreeBSD Foundation (cherry picked from commit 63a40b65c9be74193bb07a76fd66c249bd562eae) --- sys/contrib/dev/mediatek/mt76/agg-rx.c | 2 +- sys/contrib/dev/mediatek/mt76/mt7615/mac.c | 2 +- sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h | 1 + sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c | 1 + sys/contrib/dev/mediatek/mt76/mt7925/mac.c | 1 + sys/contrib/dev/mediatek/mt76/mt7996/mac.c | 1 + sys/contrib/dev/mediatek/mt76/mt7996/main.c | 2 +- sys/contrib/dev/mediatek/mt76/mt7996/mcu.c | 2 +- sys/contrib/dev/mediatek/mt76/scan.c | 4 +--- 9 files changed, 9 insertions(+), 7 deletions(-) diff --git a/sys/contrib/dev/mediatek/mt76/agg-rx.c b/sys/contrib/dev/mediatek/mt76/agg-rx.c index 3d34caf7e4f7..bf1babac3895 100644 --- a/sys/contrib/dev/mediatek/mt76/agg-rx.c +++ b/sys/contrib/dev/mediatek/mt76/agg-rx.c @@ -248,7 +248,7 @@ int mt76_rx_aggr_start(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tidno, mt76_rx_aggr_stop(dev, wcid, tidno); - tid = kzalloc(struct_size(tid, reorder_buf, size), GFP_KERNEL); + tid = kzalloc_flex(*tid, reorder_buf, size); if (!tid) return -ENOMEM; diff --git a/sys/contrib/dev/mediatek/mt76/mt7615/mac.c b/sys/contrib/dev/mediatek/mt76/mt7615/mac.c index a4a252dc0186..0ba8a0a6fe8f 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7615/mac.c +++ b/sys/contrib/dev/mediatek/mt76/mt7615/mac.c @@ -1058,7 +1058,7 @@ mt7615_mac_queue_rate_update(struct mt7615_phy *phy, struct mt7615_sta *sta, if (work_pending(&dev->rate_work)) return -EBUSY; - wrd = kzalloc(sizeof(*wrd), GFP_ATOMIC); + wrd = kzalloc_obj(*wrd, GFP_ATOMIC); if (!wrd) return -ENOMEM; diff --git a/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h b/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h index e16865dd8e52..c93fd245c90f 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h +++ b/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h @@ -5,6 +5,7 @@ #define __MT7615_H #include +#include #include #include #include diff --git a/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c b/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c index 3304b5971be0..b41ca1410da9 100644 --- a/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c +++ b/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c @@ -413,6 +413,7 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi, u32 val; if (ieee80211_is_action(fc) && + skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 + 1 + 2 && mgmt->u.action.category == WLAN_CATEGORY_BACK && mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) { u16 capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab); diff --git a/sys/contrib/dev/mediatek/mt76/mt7925/mac.c b/sys/contrib/dev/mediatek/mt76/mt7925/mac.c index 1b1a23198b9f..b0a6f42e07a0 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7925/mac.c +++ b/sys/contrib/dev/mediatek/mt76/mt7925/mac.c @@ -668,6 +668,7 @@ mt7925_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi, u32 val; if (ieee80211_is_action(fc) && + skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 && mgmt->u.action.category == WLAN_CATEGORY_BACK && mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) tid = MT_TX_ADDBA; diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/mac.c b/sys/contrib/dev/mediatek/mt76/mt7996/mac.c index b884f4475021..e74c7b771e97 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7996/mac.c +++ b/sys/contrib/dev/mediatek/mt76/mt7996/mac.c @@ -804,6 +804,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi, u32 val; if (ieee80211_is_action(fc) && + skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 && mgmt->u.action.category == WLAN_CATEGORY_BACK && mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) { if (is_mt7990(&dev->mt76)) diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/main.c b/sys/contrib/dev/mediatek/mt76/mt7996/main.c index beed795edb24..f16135f0b7f9 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7996/main.c +++ b/sys/contrib/dev/mediatek/mt76/mt7996/main.c @@ -966,7 +966,7 @@ mt7996_mac_sta_init_link(struct mt7996_dev *dev, mtxq->wcid = idx; } } else { - msta_link = kzalloc(sizeof(*msta_link), GFP_KERNEL); + msta_link = kzalloc_obj(*msta_link); if (!msta_link) return -ENOMEM; diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c b/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c index 1e21c05bae28..d6ea60876a14 100644 --- a/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c +++ b/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c @@ -745,7 +745,7 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb) struct mt7996_wed_rro_session_id *session; e = (void *)skb->data; - session = kzalloc(sizeof(*session), GFP_ATOMIC); + session = kzalloc_obj(*session, GFP_ATOMIC); if (!session) break; diff --git a/sys/contrib/dev/mediatek/mt76/scan.c b/sys/contrib/dev/mediatek/mt76/scan.c index ff9176cdee3d..63b0447e55c1 100644 --- a/sys/contrib/dev/mediatek/mt76/scan.c +++ b/sys/contrib/dev/mediatek/mt76/scan.c @@ -63,10 +63,8 @@ mt76_scan_send_probe(struct mt76_dev *dev, struct cfg80211_ssid *ssid) rcu_read_lock(); - if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) { - ieee80211_free_txskb(phy->hw, skb); + if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) goto out; - } info = IEEE80211_SKB_CB(skb); if (req->no_cck)