[PATCH v2 0/3] wifi: iwlwifi: mld: fix UAF and soft lockup on firmware error

[Cole Leavitt <cole@unwrap.rs>]

Three fixes for the iwlmld sub-driver addressing use-after-free,
TSO segmentation explosion, and soft lockups during firmware error
recovery on Intel BE200 (WiFi7).

1/3 closes the NAPI race window where stale RX data from dying
firmware reaches the TX completion handlers, causing corrupt SSN
values to trigger skb use-after-free in iwl_trans_reclaim().
Ben Greear confirmed the WARN_ONCE fires on his test systems.

2/3 fixes the TSO segmentation explosion when AMSDU is disabled
for a TID. The TLC notification sets max_tid_amsdu_len to the
sentinel value 1, which slips past the existing zero check and
produces num_subframes=0, causing skb_gso_segment() to create
32000+ tiny segments. Revised per Miriam Korenblit's feedback to
check for the sentinel value directly and add a WARN_ON_ONCE
guard after the division as defense-in-depth.

3/3 adds STATUS_FW_ERROR checks in the TX pull path to stop
feeding frames to dead firmware. Revised per Johannes Berg's
feedback to use status bit checks instead of stop_queues/wake_queues,
which doesn't interact well with TXQ-based APIs.

Changes since v1:
  - 1/3: Added Tested-by from Ben Greear
  - 2/3: Check max_tid_amsdu_len == 1 (sentinel) instead of
    guarding !num_subframes after division; added WARN_ON_ONCE
    defense-in-depth (Suggested-by: Miriam Korenblit)
  - 3/3: Replaced ieee80211_stop_queues()/wake_queues() with
    STATUS_FW_ERROR checks in TX pull path (per Johannes Berg)

Cole Leavitt (3):
  wifi: iwlwifi: prevent NAPI processing after firmware error
  wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is
    disabled
  wifi: iwlwifi: mld: skip TX when firmware is dead

 .../net/wireless/intel/iwlwifi/mld/mac80211.c |   4 +
 drivers/net/wireless/intel/iwlwifi/mld/tx.c   | 210 +++++------
 .../wireless/intel/iwlwifi/pcie/gen1_2/rx.c   | 337 +++++++++---------
 3 files changed, 284 insertions(+), 267 deletions(-)


base-commit: 3aae9383f42f687221c011d7ee87529398e826b3
-- 
2.52.0