Merge tag 'wireless-next-2025-01-17' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next

Kalle Valo says:

====================
wireless-next patches for v6.14

Most likely the last "new features" pull request for v6.14 and this is
a bigger one. Multi-Link Operation (MLO) work continues both in stack
in drivers. Few new devices supported and usual fixes all over.

Major changes:

cfg80211
 * Emergency Preparedness Communication Services (EPCS) station mode support

mac80211
 * an option to filter a sta from being flushed
 * some support for RX Operating Mode Indication (OMI) power saving
 * support for adding and removing station links for MLO

iwlwifi
 * new device ids
 * rework firmware error handling and restart

rtw88
 * RTL8812A: RFE type 2 support
 * LED support

rtw89
 * variant info to support RTL8922AE-VS

mt76
 * mt7996: single wiphy multiband support (preparation for MLO)
 * mt7996: support for more variants
 * mt792x: P2P_DEVICE support
 * mt7921u: TP-Link TXE50UH support

ath12k
 * enable MLO for QCN9274 (although it seems to be broken with dual
   band devices)
 * MLO radar detection support
 * debugfs: transmit buffer OFDMA, AST entry and puncture stats

* tag 'wireless-next-2025-01-17' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (322 commits)
  wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
  wifi: rtw88: add RTW88_LEDS depends on LEDS_CLASS to Kconfig
  wifi: wilc1000: unregister wiphy only after netdev registration
  wifi: cfg80211: adjust allocation of colocated AP data
  wifi: mac80211: fix memory leak in ieee80211_mgd_assoc_ml_reconf()
  wifi: ath12k: fix key cache handling
  wifi: ath12k: Fix uninitialized variable access in ath12k_mac_allocate() function
  wifi: ath12k: Remove ath12k_get_num_hw() helper function
  wifi: ath12k: Refactor the ath12k_hw get helper function argument
  wifi: ath12k: Refactor ath12k_hw set helper function argument
  wifi: mt76: mt7996: add implicit beamforming support for mt7992
  wifi: mt76: mt7996: fix beacon command during disabling
  wifi: mt76: mt7996: fix ldpc setting
  wifi: mt76: mt7996: fix definition of tx descriptor
  wifi: mt76: connac: adjust phy capabilities based on band constraints
  wifi: mt76: mt7996: fix incorrect indexing of MIB FW event
  wifi: mt76: mt7996: fix HE Phy capability
  wifi: mt76: mt7996: fix the capability of reception of EHT MU PPDU
  wifi: mt76: mt7996: add max mpdu len capability
  wifi: mt76: mt7921: avoid undesired changes of the preset regulatory domain
  ...
====================

Link: https://patch.msgid.link/20250117203529.72D45C4CEDD@smtp.kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

1 files changed, 40 insertions, 7 deletions

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index d056248c43d2..cd2124329521 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -272,12 +272,19 @@ cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
 {
 	const struct element *non_inherit_elem, *parent, *sub;
 	u8 *pos = new_ie;
-	u8 id, ext_id;
+	const u8 *mbssid_index_ie;
+	u8 id, ext_id, bssid_index = 255;
 	unsigned int match_len;
 
 	non_inherit_elem = cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
 						  subie, subie_len);
 
+	mbssid_index_ie = cfg80211_find_ie(WLAN_EID_MULTI_BSSID_IDX, subie,
+					   subie_len);
+	if (mbssid_index_ie && mbssid_index_ie[1] > 0 &&
+	    mbssid_index_ie[2] > 0 && mbssid_index_ie[2] <= 46)
+		bssid_index = mbssid_index_ie[2];
+
 	/* We copy the elements one by one from the parent to the generated
 	 * elements.
 	 * If they are not inherited (included in subie or in the non
@@ -316,6 +323,24 @@ cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
 			continue;
 		}
 
+		/* For ML probe response, match the MLE in the frame body with
+		 * MLD id being 'bssid_index'
+		 */
+		if (parent->id == WLAN_EID_EXTENSION && parent->datalen > 1 &&
+		    parent->data[0] == WLAN_EID_EXT_EHT_MULTI_LINK &&
+		    bssid_index == ieee80211_mle_get_mld_id(parent->data + 1)) {
+			if (!cfg80211_copy_elem_with_frags(parent,
+							   ie, ielen,
+							   &pos, new_ie,
+							   new_ie_len))
+				return 0;
+
+			/* Continue here to prevent processing the MLE in
+			 * sub-element, which AP MLD should not carry
+			 */
+			continue;
+		}
+
 		/* Already copied if an earlier element had the same type */
 		if (cfg80211_find_elem_match(id, ie, (u8 *)parent - ie,
 					     &ext_id, match_len, 0))
@@ -704,7 +729,7 @@ cfg80211_parse_colocated_ap_iter(void *_data, u8 type,
 					   bss_params)))
 		return RNR_ITER_CONTINUE;
 
-	entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN, GFP_ATOMIC);
+	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 	if (!entry)
 		return RNR_ITER_ERROR;
 
@@ -713,6 +738,17 @@ cfg80211_parse_colocated_ap_iter(void *_data, u8 type,
 
 	if (!cfg80211_parse_ap_info(entry, tbtt_info, tbtt_info_len,
 				    data->ssid_elem, data->s_ssid_tmp)) {
+		struct cfg80211_colocated_ap *tmp;
+
+		/* Don't add duplicate BSSIDs on the same channel. */
+		list_for_each_entry(tmp, &data->ap_list, list) {
+			if (ether_addr_equal(tmp->bssid, entry->bssid) &&
+			    tmp->center_freq == entry->center_freq) {
+				kfree(entry);
+				return RNR_ITER_CONTINUE;
+			}
+		}
+
 		data->n_coloc++;
 		list_add_tail(&entry->list, &data->ap_list);
 	} else {
@@ -763,12 +799,11 @@ static  void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
 		}
 	}
 
+	request->n_channels++;
 	request->channels[n_channels] = chan;
 	if (add_to_6ghz)
 		request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
 			n_channels;
-
-	request->n_channels++;
 }
 
 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
@@ -858,9 +893,7 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
 			if (ret)
 				continue;
 
-			entry = kzalloc(sizeof(*entry) + IEEE80211_MAX_SSID_LEN,
-					GFP_ATOMIC);
-
+			entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 			if (!entry)
 				continue;