[PATCH] wifi: mac80211: reject invalid EHT guard intervals in airtime estimates

[Zhao Li]

An invalid EHT guard interval can select the wrong airtime group and, at
320 MHz, read beyond airtime_mcs_groups.

Guard interval 3 advances EHT_GROUP_IDX() into the next bandwidth group
at narrower widths. With one spatial stream and 320 MHz, it evaluates to
264, one past the 264-entry table. RX rate parsing rejects the value, but
the common TX-status validator has no EHT check and last_rate_info can
carry it to the airtime helper.

Reject values above NL80211_RATE_INFO_EHT_GI_3_2 in the helper. This also
protects exported ieee80211_calc_rx_airtime() callers that do not pass
through the TX-status validator.

LLM assistance was used to find the bug and review.

Fixes: 3702a33216e6 ("wifi: mac80211: introduce EHT rate support in AQL airtime")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Zhao Li <enderaoelyther@xxxxxxxxx>
---
Validation: A W=1 module build with MODPOST passed. A QEMU
KASAN guest calling ieee80211_calc_rx_airtime() with a synthetic EHT status
changed 8 global-out-of-bounds reports to 0; guard interval 3 returned zero
instead of a wrong neighbouring-bandwidth estimate. A real device TX-status
path was not run. A reproducer is available on request.
Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.

 net/mac80211/airtime.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/mac80211/airtime.c b/net/mac80211/airtime.c
index a4e1f33c0377..c31540ff42e0 100644
--- a/net/mac80211/airtime.c
+++ b/net/mac80211/airtime.c
@@ -550,6 +550,8 @@ static u32 ieee80211_get_rate_duration(struct ieee80211_hw *hw,
 		group = HE_GROUP_IDX(streams, status->he_gi, bw);
 		break;
 	case RX_ENC_EHT:
+		if (status->eht.gi > NL80211_RATE_INFO_EHT_GI_3_2)
+			return 0;
 		streams = status->nss;
 		idx = status->rate_idx;
 		group = EHT_GROUP_IDX(streams, status->eht.gi, bw);

base-commit: 25e73f1d6868c759c8eb56cad4e411692c5341b4
-- 
2.56.0