mt76: update Mediatek's mt76 driver

This version is based on
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
028ef9c96e96197026887c0f092424679298aae8 ( tag: v7.0 ).

Sponsored by:	The FreeBSD Foundation
MFC after:	3 days

9 files changed, 9 insertions, 7 deletions

diff --git a/sys/contrib/dev/mediatek/mt76/agg-rx.c b/sys/contrib/dev/mediatek/mt76/agg-rx.c
index 3d34caf7e4f7..bf1babac3895 100644
--- a/sys/contrib/dev/mediatek/mt76/agg-rx.c
+++ b/sys/contrib/dev/mediatek/mt76/agg-rx.c
@@ -248,7 +248,7 @@ int mt76_rx_aggr_start(struct mt76_dev *dev, struct mt76_wcid *wcid, u8 tidno,
 
 	mt76_rx_aggr_stop(dev, wcid, tidno);
 
-	tid = kzalloc(struct_size(tid, reorder_buf, size), GFP_KERNEL);
+	tid = kzalloc_flex(*tid, reorder_buf, size);
 	if (!tid)
 		return -ENOMEM;
 
diff --git a/sys/contrib/dev/mediatek/mt76/mt7615/mac.c b/sys/contrib/dev/mediatek/mt76/mt7615/mac.c
index a4a252dc0186..0ba8a0a6fe8f 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7615/mac.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7615/mac.c
@@ -1058,7 +1058,7 @@ mt7615_mac_queue_rate_update(struct mt7615_phy *phy, struct mt7615_sta *sta,
 	if (work_pending(&dev->rate_work))
 		return -EBUSY;
 
-	wrd = kzalloc(sizeof(*wrd), GFP_ATOMIC);
+	wrd = kzalloc_obj(*wrd, GFP_ATOMIC);
 	if (!wrd)
 		return -ENOMEM;
 
diff --git a/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h b/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h
index e16865dd8e52..c93fd245c90f 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h
+++ b/sys/contrib/dev/mediatek/mt76/mt7615/mt7615.h
@@ -5,6 +5,7 @@
 #define __MT7615_H
 
 #include <linux/completion.h>
+#include <linux/hex.h>
 #include <linux/interrupt.h>
 #include <linux/ktime.h>
 #include <linux/regmap.h>
diff --git a/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c b/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c
index 3304b5971be0..b41ca1410da9 100644
--- a/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c
+++ b/sys/contrib/dev/mediatek/mt76/mt76_connac_mac.c
@@ -413,6 +413,7 @@ mt76_connac2_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
 	u32 val;
 
 	if (ieee80211_is_action(fc) &&
+	    skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 + 1 + 2 &&
 	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&
 	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {
 		u16 capab = le16_to_cpu(mgmt->u.action.u.addba_req.capab);
diff --git a/sys/contrib/dev/mediatek/mt76/mt7925/mac.c b/sys/contrib/dev/mediatek/mt76/mt7925/mac.c
index 1b1a23198b9f..b0a6f42e07a0 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7925/mac.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7925/mac.c
@@ -668,6 +668,7 @@ mt7925_mac_write_txwi_80211(struct mt76_dev *dev, __le32 *txwi,
 	u32 val;
 
 	if (ieee80211_is_action(fc) &&
+	    skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 &&
 	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&
 	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ)
 		tid = MT_TX_ADDBA;
diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/mac.c b/sys/contrib/dev/mediatek/mt76/mt7996/mac.c
index b884f4475021..e74c7b771e97 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7996/mac.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7996/mac.c
@@ -804,6 +804,7 @@ mt7996_mac_write_txwi_80211(struct mt7996_dev *dev, __le32 *txwi,
 	u32 val;
 
 	if (ieee80211_is_action(fc) &&
+	    skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 &&
 	    mgmt->u.action.category == WLAN_CATEGORY_BACK &&
 	    mgmt->u.action.u.addba_req.action_code == WLAN_ACTION_ADDBA_REQ) {
 		if (is_mt7990(&dev->mt76))
diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/main.c b/sys/contrib/dev/mediatek/mt76/mt7996/main.c
index beed795edb24..f16135f0b7f9 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7996/main.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7996/main.c
@@ -966,7 +966,7 @@ mt7996_mac_sta_init_link(struct mt7996_dev *dev,
 			mtxq->wcid = idx;
 		}
 	} else {
-		msta_link = kzalloc(sizeof(*msta_link), GFP_KERNEL);
+		msta_link = kzalloc_obj(*msta_link);
 		if (!msta_link)
 			return -ENOMEM;
 
diff --git a/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c b/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c
index 1e21c05bae28..d6ea60876a14 100644
--- a/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c
+++ b/sys/contrib/dev/mediatek/mt76/mt7996/mcu.c
@@ -745,7 +745,7 @@ mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
 			struct mt7996_wed_rro_session_id *session;
 
 			e = (void *)skb->data;
-			session = kzalloc(sizeof(*session), GFP_ATOMIC);
+			session = kzalloc_obj(*session, GFP_ATOMIC);
 			if (!session)
 				break;
 
diff --git a/sys/contrib/dev/mediatek/mt76/scan.c b/sys/contrib/dev/mediatek/mt76/scan.c
index ff9176cdee3d..63b0447e55c1 100644
--- a/sys/contrib/dev/mediatek/mt76/scan.c
+++ b/sys/contrib/dev/mediatek/mt76/scan.c
@@ -63,10 +63,8 @@ mt76_scan_send_probe(struct mt76_dev *dev, struct cfg80211_ssid *ssid)
 
 	rcu_read_lock();
 
-	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) {
-		ieee80211_free_txskb(phy->hw, skb);
+	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL))
 		goto out;
-	}
 
 	info = IEEE80211_SKB_CB(skb);
 	if (req->no_cck)