[PATCH v2 0/2] wifi: handle S1G and extension-frame RX layout

[Zhao Li]

Hi,

v2 keeps the mac80211 RX fix focused on the extension-frame layout and
adds a small cfg80211 companion fix for S1G scan-result TSF handling.

The first patch changes the RX entry path to validate and linearize S1G
beacons before generic RX dispatch, route S1G beacons without regular
addr2 station lookup, and drop unsupported extension frames before they
can reach regular-header address handling.

The second patch keeps cfg80211's regular management-frame TSF read out
of the S1G path and derives the S1G BSS TSF from the S1G beacon timestamp
and the S1G Beacon Compatibility element.

For process clarity: I used AI-assisted tooling for data-flow tracing,
state-machine analysis, code review, security checks, side-effect review,
and patch drafting. I reviewed the result and take responsibility for the
submission.

Changes since v1:
- Linearize S1G beacon SKBs together with management frames instead of
  using a later pskb_may_pull() check.
- Keep the management-frame and S1G beacon minimum-length checks tied to
  their respective frame layouts.
- Route S1G beacons through the station/default-link RX path without
  regular addr2 station lookup.
- Avoid repeated per-sink S1G guards in the address-copy and MLO
  translation paths by invoking RX handlers directly for S1G beacons.
- Drop unsupported non-S1G extension frames before generic RX dispatch.
- Add the cfg80211 S1G TSF companion fix.

Zhao Li (2):
  wifi: mac80211: validate extension-frame layout before RX
  wifi: cfg80211: derive S1G beacon TSF from S1G fields

 net/mac80211/rx.c   | 34 ++++++++++++++++++++++++++++++++--
 net/mac80211/util.c |  3 +++
 net/wireless/scan.c |  5 +++--
 3 files changed, 38 insertions(+), 4 deletions(-)

-- 
2.50.1 (Apple Git-155)