WireGuard for the Linux kernel https://git.zx2c4.com/wireguard-linux/atom/drivers/staging?h=stable 2026-08-25T17:16:19Z 2026-08-25T17:16:19Z Linus Torvalds torvalds@linux-foundation.org 2026-08-25T17:16:19Z urn:sha1:29b0977977d7b77b192e434d1a94628cf006f795 Pull staging driver updates from Greg KH: "Here is the big set of drivers/staging/ updates for 7.3-rc1. Nothing major in here at all, just lots of tiny coding style cleanups, refactoring, and minor "fixes" as found by some tools. Included in here - loads of coding style and refactoring in the rtl8723bs wireless driver - minor greybus driver cleanups - minor sm750fb driver cleanups - other even smaller driver cleanups All of these have been in linux-next for a weeks with no reported issues" * tag 'staging-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (186 commits) staging: rtl8723bs: add blank line after declaration staging: rtl8723bs: remove unused enumerations staging: rtl8723bs: use !psta instead of comparison to NULL staging: rtl8723bs: Replace custom RotR1 macro with ror16 staging: rtl8723bs: Remove multiple assignments staging: rtl8723bs: fix several line spaces in wifi.h staging: rtl8723bs: remove redundant goto in rtw_free_xmitframe() staging: rtl8723bs: rename Restore_DM_Func_Flag functions to avoid CamelCase staging: rtl8723bs: rename Save_DM_Func_Flag functions to avoid CamelCase staging: rtl8723bs: wrap line over 100 characters staging: rtl8723bs: remove unnecessary whitespace staging: rtl8723bs: remove extra blank lines in rtw_qos.h staging: rtl8723bs: remove redundant ReadChipVersion8723B wrapper staging: rtl8723bs: remove debug fields from hal_com_data staging: rtl8723bs: remove 'rf_chip' from struct hal_com_data staging: rtl8723bs: remove unused spinlock 'SdioTxFIFOFreePageLock' staging: rtl8723bs: remove unused 'UsbRxHighSpeedMode' from hal_com_data staging: rtl8723bs: hal: remove unused readings from the chip staging: rtl8723bs: remove unused 'bNeedIQK' from struct hal_com_data staging: rtl8723bs: remove unused 'bIQKInitialized ' from hal_com_data ... 2026-08-25T16:38:50Z Linus Torvalds torvalds@linux-foundation.org 2026-08-25T16:38:50Z urn:sha1:93e4b3076b5f2d853462b9777d083c77fc0b7b23 Pull char/misc/IIO/etc driver updates from Greg KH: "Here is the big set of char, misc, iio, counter, fpga, and other small driver subsystems for 7.3-rc1. Overall, due to some driver removals we only added a bit more code than removed, which was a nice change. Highlights in this merge request are: - Loads of IIO driver updates and additions - binder driver updates (more on that below...) - Removal of the SGI XP and GRU drivers as they are not used anymore and turn out to be pretty insecure overall - Removal of the obsolete ibmasm driver as it's not being used anymore - Coresight driver updates and additions - Mei driver udpates - Counter driver updates - FPGA driver updates - ICC driver updates - lots and lots of other tiny driver updates to resolve reported issues All of these have been in linux-next for a while" * tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits) iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF iio: adc: pac1921: fix wrong channel used in trigger handler read iio: light: gp2ap002: re-enable irq if runtime suspend fails iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes iio: light: apds9306: fix PM reference leak in apds9306_read_data() iio: gyro: mpu3050: fix sign of raw angular velocity readings iio: srf04: fix pm_runtime handling on probe error path iio: adc: ad4080: configure backend data size iio: adc: adi-axi-adc: add data size support for AD408X backend iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable iio: dac: ad5446: fix OF module device table iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask iio: light: opt4001: Reject integration times with a non-zero seconds part iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() iio: light: opt4001: Fix power down clearing bits of the wrong register iio: light: opt4060: Fix incorrect register name in threshold read error message iio: light: opt4060: Fix pointer type passed to div_u64_rem() iio: light: opt4060: Reject integration times with a non-zero seconds part iio: light: ltrf216a: fix runtime PM reference leak in error path iio: pressure: dps310: fix NULL pointer dereference on ACPI probe ... 2026-08-20T15:16:04Z Linus Torvalds torvalds@linux-foundation.org 2026-08-20T15:16:04Z urn:sha1:91ec2035134982b98fab0609a9fd8480e8217dc1 Pull networking updates from Jakub Kicinski: "One of the 'small improvements all over the place' releases for us. It's hard to draw any direct comparisons because summer vacations disrupted our patch processing (and presumably - generation) quite a bit. Quick and dirty count suggests we (Paolo and I) merged a very similar number of net (632) and net-next (648) patches. This is not telling the full story either because 1/3 to 1/2 of the net-next patches also *seem* like AI-driven low priority fixes, cleanups and clarifications. We are completely overwhelmed, of course. The glimmer of hope is that we secured sufficient LLM budget and access (thank you Meta!) to run reviews with multiple frontier models on each patch. This eliminates some hallucinations. That said, in terms of review, the LLMs can only do so much. The sad truth is that our APIs (especially for rare events like PCIe errors, timeouts etc) have always been racy, and now LLMs don't let us ignore that. I expect our direction for the next release will be to tweak the reviews a little bit more, but start shifting focus to letting the LLMs take care of the busy work - managing patchwork, automating common process complaints, editing commit messages, and maybe applying patches which already got "reviewed-by" tags from people we trust... Core & protocols: - A few steps lowering rtnl_lock dependence: - per-netns netdev unregistration for select SW drivers (e.g. veth, ipvlan, tunnels) - rtnl_lock-less FIB rule changes (RTM_NEWRULE and RTM_DELRULE) - prepare software drivers and TC qdiscs for rtnl_lock-less GET - Support BIG TCP (>64kB TSO) in UDP tunnels (vxlan, geneve) - Support buffers larger than PAGE_SIZE in devmem zero-copy API - Improve MPTCP handling of extreme memory pressure handling, when out-of-order queue had to be pruned - Report the per-group user count via RTM_GETMULTICAST - Expose the route deletion reason in RTM_DELROUTE - Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more useful handling of LSM denials when receiving SCM_RIGHTS messages: instead of truncating the message at the first blocked fd, keep every fd slot and store the LSM errno in the blocked slot - IPv6 Segment Routing - support looking up the post-encap SID (address) in a different/specified routing table - Support PRP RedBox (interlink) creation - Support per-nexthop UDP dst port in VXLAN - Continue converting getsockopt callbacks in a number of protocols to iov_iter Ethernet: - Merge initial CXL support for AMD/Solarflare NICs (shared branch with the CXL tree) - New drivers: - ADIN1140 10BASE-T1S MACPHY - Initial skeleton of Intel iXD and ZTE Dinghai drivers - High-speed NICs: - AMD/Pensando: - support firmware flashing - Cisco (enic): - SR-IOV V2 admin channel and MBOX protocol - Huawei (hns3): - support for ethtool pfc_prevention_tout - nVidia/Mellanox: - support sharing bandwidth control across interfaces of the same device - Marvell (octeontx2-pf): - link RQ page pools to netdev for Netlink stats - Google vNIC: - XDP metadata support for DQ RDA - Microsoft vNIC: - support forcing full-page RX buffers - Other NICs: - Synopsys IP: - eic7700: support for eth1 - Microchip (lan743x): - support for RMII interface - Wangxun: - support for ethtool -G and -C for VFs - add Tx timeout and PCIe error handling - Intel (igb/igc): - RSS key get/set support - support for forcing link speed without auto-negotiation - Switches: - NXP (dpaa2): - support bonding/LAG offload - Mediatek: - mt7530: EN7528 support - initial support for MT7628 - Micrel (ksz8/9): - refactoring work to move towards library model - PTP support for KSZ8463 - nVidia/Mellanox: - support rtnl-lock-less ethtool callbacks - Realtek: - rtl8366rb: use generic RTL83xx code - support SGMII and HSGMII for RTL8367S - PHYs: - Airoha: - EcoNet EN7528 PHY support - DAPU Telecom - DAPU Telecom DAP8211R(I) Gigabit PHY support - Realtek: - support RTL8261C_CG - support RTL8261D Wireless: - nl80211: per-link statistics support for multi-link operation - mac80211: AQL/airtime-fairness support for multicast - Merge Peripheral Authentication Service (PAS) / TEE support for ath12k (shared branch with the firmware/qcom tree) - New drivers: - mm81x for Morse Micro Long-Range S1G devices - nxpwifi for NXP devices (mostly forked off from mwifiex) - Driver changes: - Broadcom (brcmfmac): - DPP support, some Cypress part update - MediaTek (mt76): - mt7928 support - mt7925 NAN support - mt7996 AP powersave improvements - Qualcomm (ath12k): - much kernel infrastructure integration work - AHB platform MultiPD support - Realtek (rt89): - LED support - RTL8922DE support - dual-BT coex for RTL8922D - Intel: - new FW version support Bluetooth: - HCI: add support for Shorter Connection Interval (SCI) feature - af_bluetooth: add minimal context analysis annotations - Driver changes: - Intel: - add Bluetooth SAR revision 2 support - add vendor_reset PCI sysfs for PLDR - Mediatek: - add USB IDs for MT7902 and MT7922 devices - Realtek: - add USB IDs for 8761CU and 8852BE devices - NXP: - add M.2 Bluetooth device support using pwrseq Misc: - DPLL support for manual/numerical oscillator control (NCO) (implement in zl3073x) - MCTP support for MCTP over USB v1.1 (DMTF DSP0283) - Power-over-Ethernet: support Realtek PSE controllers - Remove the IBM EHEA driver - Remove tulip/xircom_cb driver" * tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1433 commits) net/mlx5e: do not HW-GRO coalesce small frames net: openvswitch: fix nf_connlabels leak in ovs_ct_init net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() net: openvswitch: fix flow mask use-after-free on flow deletion sctp: stop processing a packet once its association is deleted dpll: zl3073x: add PTP clock support dpll: zl3073x: add channel ToD, phase step and TIE operations dpll: zl3073x: scale poll interval proportionally to timeout ptp: vmclock: prevent read-only mappings from becoming writable ipv4: reject undersized MTUs in ip_do_fragment() bonding: initialize err for empty target lists net: dsa: initial support for MT7628 embedded switch net: dsa: initial MT7628 tagging driver net: phy: mediatek: add phy driver for MT7628 built-in Fast Ethernet PHYs dt-bindings: net: dsa: add MT7628 ESW net: pse-pd: realtek-pse-mcu: add UART transport net: pse-pd: realtek-pse-mcu: add I2C transport net: pse-pd: add Realtek PSE MCU core dt-bindings: net: pse-pd: add bindings for Realtek PSE MCU vsock: use sock_error() to consume sk_err after a failed connect ... 2026-08-19T17:09:22Z Linus Torvalds torvalds@linux-foundation.org 2026-08-19T17:09:22Z urn:sha1:f4cdf7ca9a1fdcca413157df19753f388a5a224e Pull media updates from Mauro Carvalho Chehab: - v4l2-core: added ISP statistics support and per-block validation - v4l2-core: Allow unknown HDR10 white point and luminance - New camera sensors: Sony IMX678 and IMX471m, Himax HM1092 IR sensor - New codec: Milos: VPU v2.0 codec support - isp driver: gained support for Dreamchip RPPX1 ISP framework - vsp1 driver: gained support for RZ/T2H and RZ/N2H - Novalake driver: gained CVS support for new NVL hardware - dvb-core: fix feed leak on failed DMX_ADD_PID - several driver fixes, cleanups and minor improvements * tag 'media/v7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (308 commits) media: ipu-bridge: check all DMI entries when overriding sensor rotation media: v4l2-async: avoid deleting unlinked ASC entry on link error media: rzg2l-cru: Align bytesperline to hardware DMA stride requirement media: intel/ipu6: fix async notifier cleanup leak on parse error media: staging/ipu7: fix async notifier UAF on probe error path media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem() media: rcar-isp: Fix VSPX reference leaks media: rcar-isp: Release ISPCORE resources media: i2c: imx415: Release runtime PM reference on VBLANK error media: i2c: imx415: Return test pattern write errors media: renesas: vsp1: Declare index variables in for loop statement media: renesas: vsp1: Make reset control optional to support platforms without a reset line media: dt-bindings: media: renesas,vsp1: Document RZ/T2H and RZ/N2H SoCs media: dt-bindings: media: renesas,fcp: Document RZ/T2H and RZ/N2H SoCs media: nxp: imx8-isi: Add additional 32-bit RGB format support media: nxp: imx8-isi: Add 16-bit raw Bayer format support media: nxp: imx8-isi: Implement per-stream reference counting for multiplexed streams media: nxp: imx8-isi: Use BIT_ULL() for 64-bit stream masks media: nxp: imx8-isi: Correct color map between V4L2 and ISI ... 2026-08-19T07:45:01Z Greg Kroah-Hartman gregkh@linuxfoundation.org 2026-08-19T07:45:01Z urn:sha1:258ad625930ff4535ba6b438c8b49509e9a1c2dd Jonathan writes: IIO new device support, features, cleanup for 7.3 Includes a merge of 7.2-rc2 to pick up the changes around mod_devicetable.h and reduce resulting conflicts around includes. New device support ------------------ adi,ad3530R - Add support for the AD3532R and AD3532 16 channel DACs. adi,ad4080 - Add support for the AD4883 ADC. adi,ad5686 - Add support for AD5313R, AD5317R, AD5674, AD5687R, AD5689, AD5689R DACs over SPI - Add support for AD5316R, AD5674, AD5697R and AD5696 DACs over I2C - Significant driver refactoring prior to these additions, partly to reduce bus traffic and to add triggered buffer and gain control support. An earlier set added support for missing supplies, reset and LDAC GPIO. adi,adf41513 - New driver to support this PLL frequency synthesizer that runs up to 26.5 GHz. - Included infrastructure to handle higher precision attributes with extensive tests adi,ltc2378-20 - New driver supporting LTC2338, LTC2364, LTC2367, LTC2368, LT2369, LTC2370 LTC2376, LTC2377, LTC2378, LTC2379 and LTC23980 ADCs with both high speed capture via appropriate backend and conventional triggered buffer SPI capture. invensense,icm42607 - New driver for this IMU. mediateck,mt6323 - New driver for this PMIC ADC. microchip,mcp47a1 - New driver for this I2C 6 bit DAC. nxp,mcf54415-dac - New driver for this DAC found in NXP SoCs. qst,qmc5884l - New driver for this 3 axis magnetometer. Included dt vendor entry for qst. qst,qmc6308 - New driver for this 3 axis magnetometer. sensiron,slf3s - New driver for this liquid flow sensor. Includes adding IIO_VOLUMEFLOW channel type. st,vl53l1x - Refactors to improve readability. ti,ads112c14 - New driver supporting the ADS112C14 and ADS122C14 ADCs. These bring some new ABI for input chopping, particular useful for resistive sensors like thermocouples or Wheatstone bridges. - Support CRC8 detection of corruption on the bus. - Support buffered reads. ti,tmp117 - (trivial) Add support for the tmp119 temperature sensor. xilinx,versal-sysmon - New ADC driver for this block found on various FPGAs including various bus interfaces, threshold and oversampling support. dt binding updates ------------------ new shared bindings - excitation-channels and excitation-current-nanoamp allow per channel specification of currents used for resistive sensor measurement. - reference-sources property to allow selection of a per channel reference. rockchip,saradc - Add RV1106 which is compatible with the RV3588. Features -------- buffer-dmaengine - Allow cyclic buffers, useful for repeating sequence generation with DACs. devantech,dmard09 - Implement read back of channel scale - previously interface always returned an error. hid,sensors-als - Enable separate channel scaling for hardware that supports it. invensense,timestamp library - Various precision improvements. invensense,icm42600 - Add support for hwfifo watermark interfaces. taos,tcs3472 - Support wait time and sampling frequency control. Cleanups, minor fixes --------------------- Minor cleanups not mentioned at all in this summary such as white space fixes or typos. Affecting various drivers - Cleanup of conditionals that had no affect. - Drop some runtime pm local wrappers as now runtime_pm does the mark_last_busy part inside the put, these provide no useful code deduplication or readability advantages over directly calling the runtime_pm functions. - Return 0 from write_raw() on success. - Use of dev_err_probe() to simplify code and sometimes provide useful info for deferred probe debugging. - Drop some redundant error prints where the called function already provides information on errors. - Make some read only arrays in functions static. - Fix up missing handling of regcache_sync() errors. - Drop some false kernel-doc markings. - Add missing MODULE_DEVICE_TABLE for some of_match_id tables. - Use local variables for things like the struct device to shorten and improve readability of code. - Drop some unused structure elements. - Reorder dds.h macro parameters to be inline with others. - Header reorders and IWYU. Often part of a more significant series. - Remove abstractions designed to allow a driver to support multiple device types, when they have been around a long time and only the original part showed up. - Initialize spi_device_id arrays using member names following dropping of driver data from drivers that didn't actually use it. - Catch up with i2c_device_id tables added since previous effort to use named initializers for all those. - Use kernel types in a few places instead of standard C ones or bare unsigned. Misc - Update Xilinx AMS maintainer. - Update email address for Maxwell Doose. - Update email address for Siratul Islam. - Update email address for Tomasz Duszynski and re-add Tomasz to various maintainer entries. Docs - Encourage use of differential channel naming even when there is no flexibility in input to differential pair mapping. Intended to provide a strong signal to userspace that a channel is differential. adi,ad_sigma_delta - Allow COMPILE_TEST without any users. adi,ad2s1201 - Refactor trigger handler to avoid mix of guard() and goto. adi,ad5686 - Avoid potential NULL dereference is user forces a driver bind. adi,ad5696 - Add a couple of missing entries to the of_match_id table and update binding to match. atmel,ad91_adc - Use const char * for DT string property allowing a cast to be dropped. avia,hx711 - Various refactors and cleanup to enable support of additional parts (to come) - Add missing supply and gpio dt-bindings. bosch,bmc150 - Harden against device reporting too large a FIFO sample count. - Use FIELD_PREP() / FIELD_GET() to improve readability. freescale,fxls8962af - Harden against device reporting too large a FIFO sample count. hid-sensors-* - Reorder probe to not expose userspace interfaces until the rest of the setup is done to avoid potentially dropping data. honeywell,abp2030pa - Drop an unreachable return. invensens,icm45600 - Harden against bad value of FIFO sample count from device. - Use i2c_match_data if firmware table sourced match data isn't available. nxp,mpl1115 - Ensure runtime_pm is balanced on error in probe. rohm,bm1390 - Make the driver slightly more likely to recover from transient errors. sensiron,sgp30 - Handle thread creation errors. st,lsm6dsx - Update the enable mask when doing sensor fusion to avoid incorrect fifo data handling. st,stm32-dfsdm - Treat dt flags as booleans. ti,ads1015 - Switch to devm helpers which simplified code and closed a resource leak. ti,opt3001 - Split complicated opt3001_get_processed() logic into irq an no irq helper functions. - Use devm to simplify code. - Use guard() to simplify code. - Reorder probe so final call exposes userspace interfaces. - Various other more minor cleanup taos,tsl2772 - Fix calibscale readback to check right channel type. taos,tsl2583 - Use sysfs_emit() and sysfs_emit_at() to replace open coded equivalents. * tag 'iio-for-7.3a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (232 commits) iio: dac: mcp47a1: add support for new device dt-bindings: iio: dac: add support for mcp47a1 iio: Update email for Maxwell Doose iio: imu: st_lsm6dsx: Update enable mask when using sensor fusion iio: light: cm32181: return zero after writing calibscale iio: flow: add Sensirion SLF3S liquid flow sensor driver iio: core: add IIO_VAL_DECIMAL64_FEMTO format type dt-bindings: iio: flow: add Sensirion SLF3S liquid flow sensor iio: types: add IIO_VOLUMEFLOW channel type iio: ABI: Encourage differential voltage ABI usage iio: adc: ltc2378: Add support for LTC2338-18 iio: adc: ltc2378: Enable triggered buffer data capture iio: adc: ltc2378: Enable high-speed data capture iio: adc: ltc2378: Add support for LTC2378-20 and similar ADCs dt-bindings: iio: adc: Add ltc2378 iio: magnetometer: ak8974: remove conditional return with no effect iio: light: tsl2583: remove conditional return with no effect iio: adc: rcar-gyroadc: remove rcar_gyroadc_set_power() helper iio: light: vcnl4000: remove vcnl4000_set_pm_runtime_state() helper iio: light: vcnl4035: remove vcnl4035_set_pm_runtime_state() helper ... 2026-08-13T18:00:14Z Jakub Kicinski kuba@kernel.org 2026-08-06T18:51:42Z urn:sha1:3da8c3c8b8fa99505624b65ef590482f48e766b6 Cross-merge networking fixes after downstream PR (net-7.2-rc8). No conflicts. Adjacent changes: drivers/net/ethernet/wangxun/ngbe/ngbe_main.c 5f3a13e0bb5e ("net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling") d661abdc30c2 ("net: ngbe: correct misleading interrupt comment") drivers/net/ipvlan/ipvlan_main.c e16e960d55a4 ("ipvlan: inherit needed_headroom and needed_tailroom from phy_dev") 00a40d809207 ("ipvlan: Support per-netns netdev unregistration.") Signed-off-by: Jakub Kicinski <kuba@kernel.org> 2026-08-10T08:51:33Z Cong Nguyen congnt264@gmail.com 2026-07-30T10:37:54Z urn:sha1:d7f48aa7d60c65d3e6d5312c27f17d5525a245fb isys_register_devices() registers the V4L2 async notifier via isys_notifier_init(). If a subsequent probe step such as isys_fw_log_init() fails, isys_probe() jumps to the out_cleanup label which only calls isys_unregister_devices(). That helper tears down the video devices, subdevices, V4L2 device and media device, but never unregisters or cleans up the async notifier. As a result the notifier stays chained in the global notifier_list while the enclosing struct ipu7_isys is freed by devres, leading to list corruption and a use-after-free the next time the list is walked. The remove path already does the right thing by calling isys_notifier_cleanup() before isys_unregister_devices(). Mirror that on the probe error path so the notifier is unregistered and cleaned up before the device is torn down. Fixes: a516d36bdc3d ("media: staging/ipu7: add IPU7 input system device driver") Cc: stable@vger.kernel.org Signed-off-by: Cong Nguyen <congnt264@gmail.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> 2026-08-06T19:39:11Z Jakub Kicinski kuba@kernel.org 2026-08-06T19:39:10Z urn:sha1:4fa4977a0d900f936bcae5cd2c510be5554e8dd6 Johannes Berg says: ==================== Quite a bunch more work, of note: - iwlwifi: new FW version support - mt76: - mt7928 support - mt7925 NAN support - mt7996 AP powersave improvements - rtw89: - LED support - RTL8922DE support - dual-BT coex for RTL8922D - ath12k: AHB platform MultiPD support - cfg80211: pre-assign cookies for operations - mac80211: AQL support for multicast * tag 'wireless-next-2026-08-06' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (403 commits) wifi: nxpwifi: bound uAP association event IEs to the event buffer wifi: nxpwifi: detach sync command buffer on interrupted wait wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() wifi: rsi: Fix types to appease CFI wifi: mac80211: skip default WMM setup for AP_VLAN links wifi: nxpwifi: fix multiple static analysis errors and warnings wifi: morsemicro: MM81X should be invisible and selected by its users wifi: nxp: NXPWIFI should be invisible and selected by its users wifi: cfg80211: stop PMSR before P2P and NAN teardown wifi: mac80211: disconnect on CSA to channel 0 wifi: brcmfmac: fix P2P action frame handling without device vif wifi: brcmfmac: Set DMA direction for msgbuf packet IDs wifi: brcmfmac: validate msgbuf flowring IDs before use wifi: mac80211: fix RCU usage in peer probing wifi: mac80211: fix RCU dereference in throughput estimate wifi: wilc1000: validate monitor transmit frame headers wifi: mac80211: skip unused probe response countdown offsets wifi: zd1211rw: reject secondary interfaces to prevent conflicts wifi: nl80211: clean up color-change beacon data on errors wifi: mac80211: send TWT teardown to peer after setup TX failure ... ==================== Link: https://patch.msgid.link/20260806121304.190084-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski <kuba@kernel.org> 2026-08-02T15:40:08Z Arend van Spriel arend.vanspriel@broadcom.com 2026-07-31T12:35:07Z urn:sha1:914781c72813989b512609a51f8abb68417f722d The remain_on_channel, mgmt_tx, and probe_peer ops previously used a u64 *cookie output parameter. Now that cfg80211 pre-assigns the cookie value before invoking drivers, the parameter conveys a value from caller to driver, not the other way around. Convert it to a plain u64 input parameter across the ops struct (cfg80211.h), rdev-ops.h wrappers, nl80211.c/mlme.c call sites, mac80211, and all driver implementations. The tx_control_port op is excluded: its cookie pointer is nullable (passed as NULL when dont_wait_for_ack is set), so the nullable pointer semantics are still required. Internal mac80211 helpers ieee80211_start_roc_work() and ieee80211_attach_ack_skb() still take u64 *cookie because they assign to the pointee; their callers now pass &cookie to take the address of the local value parameter. wil6210's internal wil_p2p_listen() is also updated to take u64 cookie since it is called directly from the remain_on_channel callback. Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260731123509.1975281-12-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> 2026-08-02T15:40:08Z Arend van Spriel arend.vanspriel@broadcom.com 2026-07-31T12:35:06Z urn:sha1:51a87a1cb61cde446429e355cb66b3dbe4851a8e Stop using params->buf address as cookie value and simply pass the pre-assigned cookie in frame tx status. This implementation seems to fire-and-forget the transmitted frame as the cookie is not used in any other way. Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260731123509.1975281-11-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>