Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 22 Apr 2026 21:09:10 +0000
From:      Bjoern A. Zeeb <bz@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org
Subject:   git: 808910385ce9 - stable/15 - mt76: update Mediatek's mt76 driver
Message-ID:  <69e938f6.30a2d.19a6264e@gitrepo.freebsd.org>

index | next in thread | raw e-mail

The branch stable/15 has been updated by bz:

URL: https://cgit.FreeBSD.org/src/commit/?id=808910385ce968d1bd056633cc595256e4d1f6f6

commit 808910385ce968d1bd056633cc595256e4d1f6f6
Author:     Bjoern A. Zeeb <bz@FreeBSD.org>
AuthorDate: 2026-04-18 21:01:39 +0000
Commit:     Bjoern A. Zeeb <bz@FreeBSD.org>
CommitDate: 2026-04-22 20:57:13 +0000

    mt76: update Mediatek's mt76 driver
    
    This version is based on
    git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    028ef9c96e96197026887c0f092424679298aae8 ( tag: v7.0 ).
    
    Sponsored by:   The FreeBSD Foundation
    
    (cherry picked from commit 63a40b65c9be74193bb07a76fd66c249bd562eae)
---
 sys/contrib/dev/mediatek/mt76/agg-rx.c          | 2 +-
 sys/contrib/dev/mediatek/mt76/mt7615/mac.c      | 2 +-
 sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h   | 1 +
 sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c | 1 +
 sys/contrib/dev/mediatek/mt76/mt7925/mac.c      | 1 +
 sys/contrib/dev/mediatek/mt76/mt7996/mac.c      | 1 +
 sys/contrib/dev/mediatek/mt76/mt7996/main.c     | 2 +-
 sys/contrib/dev/mediatek/mt76/mt7996/mcu.c      | 2 +-
 sys/contrib/dev/mediatek/mt76/scan.c            | 4 +---
 9 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/sys/contrib/dev/mediatek/mt76/agg-rx.c b/sys/contrib/dev/mediatek/mt76/agg-rx.c
index 3d34caf7e4f7..bf1babac3895 100644
--- a/sys/contrib/dev/mediatek/mt76/agg-rx.c
+++ b/sys/contrib/dev/mediatek/mt76/agg-rx.c
@@ -248,7 +248,7 @@ int mt76_rx_aggr_start(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tidno,
 
 	mt76_rx_aggr_stop(dev, wcid, tidno);
 
-	tid = kzalloc(struct_size(tid, reorder_buf, size), GFP_KERNEL);
+	tid = kzalloc_flex(*tid, reorder_buf, size);
 	if (!tid)
 		return -ENOMEM;
 
diff --git a/sys/contrib/dev/mediatek/mt76/mt7615/mac.c b/sys/contrib/dev/mediatek/mt76/mt7615/mac.c
index a4a252dc0186..0ba8a0a6fe8f 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7615/mac.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7615/mac.c
@@ -1058,7 +1058,7 @@ mt7615_mac_queue_rate_update(struct mt7615_phy *phy, struct mt7615_sta *sta,
 	if (work_pending(&dev->rate_work))
 		return -EBUSY;
 
-	wrd = kzalloc(sizeof(*wrd), GFP_ATOMIC);
+	wrd = kzalloc_obj(*wrd, GFP_ATOMIC);
 	if (!wrd)
 		return -ENOMEM;
 
diff --git a/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h b/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h
index e16865dd8e52..c93fd245c90f 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h
+++ b/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h
@@ -5,6 +5,7 @@
 #define __MT7615_H
 
 #include <linux/completion.h>
+#include <linux/hex.h>
 #include <linux/interrupt.h>
 #include <linux/ktime.h>
 #include <linux/regmap.h>
diff --git a/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c b/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c
index 3304b5971be0..b41ca1410da9 100644
--- a/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c
+++ b/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c
@@ -413,6 +413,7 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
 	u32 val;
 
 	if (ieee80211_is_action(fc) &&
+	    skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 + 1 + 2 &&
 	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&
 	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {
 		u16 capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
diff --git a/sys/contrib/dev/mediatek/mt76/mt7925/mac.c b/sys/contrib/dev/mediatek/mt76/mt7925/mac.c
index 1b1a23198b9f..b0a6f42e07a0 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7925/mac.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7925/mac.c
@@ -668,6 +668,7 @@ mt7925_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
 	u32 val;
 
 	if (ieee80211_is_action(fc) &&
+	    skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 &&
 	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&
 	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ)
 		tid = MT_TX_ADDBA;
diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/mac.c b/sys/contrib/dev/mediatek/mt76/mt7996/mac.c
index b884f4475021..e74c7b771e97 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7996/mac.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7996/mac.c
@@ -804,6 +804,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
 	u32 val;
 
 	if (ieee80211_is_action(fc) &&
+	    skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 &&
 	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&
 	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {
 		if (is_mt7990(&dev->mt76))
diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/main.c b/sys/contrib/dev/mediatek/mt76/mt7996/main.c
index beed795edb24..f16135f0b7f9 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7996/main.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7996/main.c
@@ -966,7 +966,7 @@ mt7996_mac_sta_init_link(struct mt7996_dev *dev,
 			mtxq->wcid = idx;
 		}
 	} else {
-		msta_link = kzalloc(sizeof(*msta_link), GFP_KERNEL);
+		msta_link = kzalloc_obj(*msta_link);
 		if (!msta_link)
 			return -ENOMEM;
 
diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c b/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c
index 1e21c05bae28..d6ea60876a14 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c
@@ -745,7 +745,7 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
 			struct mt7996_wed_rro_session_id *session;
 
 			e = (void *)skb->data;
-			session = kzalloc(sizeof(*session), GFP_ATOMIC);
+			session = kzalloc_obj(*session, GFP_ATOMIC);
 			if (!session)
 				break;
 
diff --git a/sys/contrib/dev/mediatek/mt76/scan.c b/sys/contrib/dev/mediatek/mt76/scan.c
index ff9176cdee3d..63b0447e55c1 100644
--- a/sys/contrib/dev/mediatek/mt76/scan.c
+++ b/sys/contrib/dev/mediatek/mt76/scan.c
@@ -63,10 +63,8 @@ mt76_scan_send_probe(struct mt76_dev *dev, struct cfg80211_ssid *ssid)
 
 	rcu_read_lock();
 
-	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) {
-		ieee80211_free_txskb(phy->hw, skb);
+	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL))
 		goto out;
-	}
 
 	info = IEEE80211_SKB_CB(skb);
 	if (req->no_cck)


home | help

Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?69e938f6.30a2d.19a6264e>