[PATCH 0/4] wifi: nxpwifi: fix AP channel-switch lifetime and failures

[Zhao Li]

NXPWIFI retains request-owned beacon buffers for delayed AP channel-switch
work. Once the nl80211 request is released, the IE parser can read freed
memory and copy stale bytes into management-IE commands sent to firmware.

Deep-copy that beacon data, cancel pending work when the AP stops, defer
blocking AP traffic until switch preparation succeeds, and stop the
interface when delayed work cannot complete the switch.

The series was not run on IW61x hardware. Testing from IW61x users would
be helpful. All four patches apply without changes to v7.3. Patch 3 has
144 hunk-body lines with context, above the stable tree's 100-line limit,
so patches 3 and 4 need a smaller reviewed backport.
LLM assistance was used to review this series.

Zhao Li (4):
  wifi: nxpwifi: cancel channel switch work on teardown
  wifi: nxpwifi: stop AP TX after preparing channel switch
  wifi: nxpwifi: own beacon data used by channel switch work
  wifi: nxpwifi: stop AP when delayed channel switch fails

 drivers/net/wireless/nxp/nxpwifi/11h.c      | 22 ++++--
 drivers/net/wireless/nxp/nxpwifi/cfg80211.c | 74 ++++++++++++++++++---
 drivers/net/wireless/nxp/nxpwifi/main.h     |  2 +-
 3 files changed, 81 insertions(+), 17 deletions(-)


base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4
-- 
2.56.0