From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f182.google.com (mail-pg1-f182.google.com [209.85.215.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8660B3AE6E9 for ; Wed, 8 Jul 2026 19:59:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783540769; cv=none; b=VrK/VN8sipt2OyPzYrLZHsu8EksN2pqtDxvjg2ON+FBsVqHK9C0MvgsRf/BhxOL+Ac8VDi5JC0n0u6d1AAMm1B3igRGp/CfLZo7l0rhLDmdT6jAsA2gAavFQdsbOVW8SMvHbpdaEItO21XDACT4A/fYcK31o07lSs7fisBISB0Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783540769; c=relaxed/simple; bh=6b+OKTBXJLin46o7fI8ZjbLsknwlqT2udjnzde6o+/o=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Qe+uw/JmaWkuHfP3yvf+MII2ws/An520zBjcK8HEARGmxbcvDVeIIFkNH/DX1W+fQfh4aVDiWnanOoIfQLu1JENhMyzjOQyBOSMW1y4XrE+tyglV09qCIe8lrVPwqLln0beCdQwhiflzfRBIZXbdyKtWRLrnwSYrD70okL5+KhA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=opCMbN+8; arc=none smtp.client-ip=209.85.215.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="opCMbN+8" Received: by mail-pg1-f182.google.com with SMTP id 41be03b00d2f7-ca766c1c9ccso570616a12.0 for ; Wed, 08 Jul 2026 12:59:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783540768; x=1784145568; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=9SLXuxSjMjH+b7omN5N/fV/XznfXy4RVRoriiTuBMrw=; b=opCMbN+8ZY7ZN1UP3WlYgE0Hi1jheol8JbR4MLpilX+EujSZG3/lYJQ66qGvG4j7im m224nb1I9eYkhsORZ8PtD9BSF02Fj7btwXo4QbkyK6BrY4hJoNbT1K/Wyxjqw3SEJWXE 4oZ50ktct6cpUxQRP1MIvpUE+RIYSDVHcG+IHAWATnZbmK+gAA6liY9cf+gmlnzrV7Z3 oo3zFCdf9ngSo+O+X0lG7UE6yjORr84TV1OiQK2QeNbqfL+/3fZ2NIbXGqh/XYwmz95V OY5cZbbEag8z6OXnK0RleB2HYBZlXqT2nX+ibWA9Ec4p9DF/a9xzlQ5UkVyxvrRRqjhI pW7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783540768; x=1784145568; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=9SLXuxSjMjH+b7omN5N/fV/XznfXy4RVRoriiTuBMrw=; b=Pr4opa04xh4/w+ELRilhLgS348BXR146XgHpE9lfG5SDpwfooNZH4A/L5NkvW45aok Y7aEZuyMof32A1wJClE+i4UH0TPKTVpYBNobiQBt5QD8vUHVnpC9HmGVYsXAJZ7NSi3T 4Hp6rZiTYwVIwQSTLAfp3G7mxvozJTLisJbWElMyydKW8LoJPCKL/9M05RMjYjc2qKg1 +YKHFzxu4Odp5gVxIiS4Vc0gkJ/UQnC9SWIHBpRkvujz8/04OrkBt08qm2Tu24iRC2QK xQcEjyvpxaEvEFoYGnac5+EZxdY2oMgtbNL0hx4eSUL4gmJGzqFKBBZUhz6xmDc8w36q 9Z9Q== X-Gm-Message-State: AOJu0YzSU21e8cLKV2OzPKiHUMdlm+AWssgN/u81V+t90YX4daOd+MZf xk2F3w0Sb3XocoZNfV0DNslFS7f1M9cR4GTLthzEqKOSkYq07Ubw2Jgj X-Gm-Gg: AfdE7clwdLnRIBrQMJrYgIXeRJbQunHmrk7JIpjayKWPlKP4ycH9H+U/2vrntBywvx5 odFv8IogAGICVdo2dlJ1IGZxpbU/cJbs4HApcd0+j53gEPVg0ELXAbBhLFKYcfI5hXHVW3kuT4b Im7NqGKlzPsTCQEMIq6jk+7Y782v7VXgxk3SLm9MTMJL3TBETEUi4zJKLT55fuZjbhGQ8M9xyoS FevXOg7c2vPOIBPbgfsL2n4RenlIELbfQn7vBx5X0teoxSnSx6Qla+87Nb5zFpp+5uHE6vqQirD txzfEz9L1QO1kCpx4RhtcJ7FoKiYl7HVCOOjGJSvpqJ8Fa4tzL5zO7Lw7dJREmpkSmXm9J2jOqT IJkehk4jrWYa6UNu5wcuQeWmGSa3xbjqIrvJwbOtlJxJWDM2jNINqGaNYouXzwxnBIJHmRKchZj RucgfdgoHGEeOELCxlFGYyUO3yQM89HnyRV3Ef5M/x17iT8fOMK6m+ X-Received: by 2002:a05:6a20:3ca3:b0:39f:acae:f12e with SMTP id adf61e73a8af0-3c0bced482bmr5675043637.22.1783540767624; Wed, 08 Jul 2026 12:59:27 -0700 (PDT) Received: from KRHW1CJW23.bytedance.net ([139.177.225.228]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31174a8f521sm22585395eec.22.2026.07.08.12.59.20 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 08 Jul 2026 12:59:27 -0700 (PDT) From: Zhao Li To: linux-wireless@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Miri Korenblit , Brian Norris , Francesco Dolcini , Johannes Berg , Jaewan Kim , Daniel Gabay , Emmanuel Grumbach , Benjamin Berg , Anjaneyulu , Peddolla Harshavardhan Reddy , Lorenzo Bianconi , John Crispin , Avinash Patil , Cathy Luo , "John W. Linville" , Aloka Dixit , Zhao Li Subject: [PATCH 0/8] wifi: fix PMSR lifetime and frame validation issues Date: Thu, 9 Jul 2026 03:59:03 +0800 Message-ID: <20260708195911.84365-1-enderaoelyther@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Hi, This series fixes a set of PMSR lifetime and management-frame validation issues found while reviewing the wireless stack. It is based on wireless/main commit cb8afea4655f ("wifi: cfg80211: bound element ID read when checking non-inheritance"). The patches cover: - PMSR lifetime handling in mac80211_hwsim and iwlwifi MLD: hwsim drops its saved cfg80211 request pointers once an abort succeeds, hwsim reports are accepted only from the registered wmediumd sender in the matching netgroup, and iwlwifi MLD gains an abort hook for active FTM PMSR requests. - cfg80211 parsing of the optional FTM NOMINAL_TIME attribute. - fixed-field validation for mac80211 probe-response countdown offsets, S1G individual TWT setup frames before driver callbacks, and mwifiex action frame category/action-code fields. - an nl80211 color-change error path that leaked the beacon data parsed for the request; it is now freed as in the other beacon setters. A larger local draft covered more issues, but the AP-template double-free, MLE and assoc/MLME length validation, S1G beacon TSF, and RNR cleanup fixes have since landed in wireless/main and are dropped here. Checks run: - git am of patches 1-8 on wireless/main cb8afea4655f: clean - scripts/checkpatch.pl --strict --no-signoff on this draft: clean - VPS x86_64 KASAN build: bzImage plus iwlwifi MLD and mwifiex modules build clean - VPS QEMU boot of the patched KASAN+hwsim kernel: a PMSR-capable hwsim radio completed PMSR_START; the stale REPORT_PMSR attempt was rejected with -EINVAL; no KASAN, use-after-free, out-of-bounds, general protection, or "unable to handle" splat was observed Zhao Li (8): wifi: mac80211_hwsim: clear PMSR request state on abort wifi: mac80211_hwsim: authenticate PMSR report senders wifi: iwlwifi: mld: abort active PMSR requests wifi: cfg80211: guard optional PMSR nominal time wifi: mac80211: validate probe response countdown offsets wifi: mac80211: validate S1G TWT params before driver setup wifi: mwifiex: validate action frame fixed fields wifi: nl80211: clean up color-change beacon data on errors .../intel/iwlwifi/mld/ftm-initiator.c | 22 +++++++++++++++++++ .../intel/iwlwifi/mld/ftm-initiator.h | 2 ++ .../net/wireless/intel/iwlwifi/mld/mac80211.c | 10 +++++++++ drivers/net/wireless/marvell/mwifiex/util.c | 9 ++++++++ .../wireless/virtual/mac80211_hwsim_main.c | 19 +++++++++++++--- net/mac80211/s1g.c | 4 ++++ net/mac80211/tx.c | 4 ++++ net/wireless/nl80211.c | 10 +++++---- net/wireless/pmsr.c | 5 +++-- 9 files changed, 76 insertions(+), 9 deletions(-) -- 2.50.1 (Apple Git-155)