[PATCH 0/8] wifi: fix PMSR lifetime and frame validation issues

[Zhao Li]

Hi,

This series fixes a set of PMSR lifetime and management-frame
validation issues found while reviewing the wireless stack.

It is based on wireless/main commit cb8afea4655f ("wifi: cfg80211: bound
element ID read when checking non-inheritance").

The patches cover:

- PMSR lifetime handling in mac80211_hwsim and iwlwifi MLD: hwsim drops
  its saved cfg80211 request pointers once an abort succeeds, hwsim
  reports are accepted only from the registered wmediumd sender in the
  matching netgroup, and iwlwifi MLD gains an abort hook for active FTM
  PMSR requests.
- cfg80211 parsing of the optional FTM NOMINAL_TIME attribute.
- fixed-field validation for mac80211 probe-response countdown offsets,
  S1G individual TWT setup frames before driver callbacks, and mwifiex
  action frame category/action-code fields.
- an nl80211 color-change error path that leaked the beacon data parsed
  for the request; it is now freed as in the other beacon setters.

A larger local draft covered more issues, but the AP-template
double-free, MLE and assoc/MLME length validation, S1G beacon TSF, and
RNR cleanup fixes have since landed in wireless/main and are dropped
here.

Checks run:

- git am of patches 1-8 on wireless/main cb8afea4655f: clean
- scripts/checkpatch.pl --strict --no-signoff on this draft: clean
- VPS x86_64 KASAN build: bzImage plus iwlwifi MLD and mwifiex
  modules build clean
- VPS QEMU boot of the patched KASAN+hwsim kernel: a PMSR-capable
  hwsim radio completed PMSR_START; the stale REPORT_PMSR attempt was
  rejected with -EINVAL; no KASAN, use-after-free, out-of-bounds,
  general protection, or "unable to handle" splat was observed

Zhao Li (8):
  wifi: mac80211_hwsim: clear PMSR request state on abort
  wifi: mac80211_hwsim: authenticate PMSR report senders
  wifi: iwlwifi: mld: abort active PMSR requests
  wifi: cfg80211: guard optional PMSR nominal time
  wifi: mac80211: validate probe response countdown offsets
  wifi: mac80211: validate S1G TWT params before driver setup
  wifi: mwifiex: validate action frame fixed fields
  wifi: nl80211: clean up color-change beacon data on errors

 .../intel/iwlwifi/mld/ftm-initiator.c         | 22 +++++++++++++++++++
 .../intel/iwlwifi/mld/ftm-initiator.h         |  2 ++
 .../net/wireless/intel/iwlwifi/mld/mac80211.c | 10 +++++++++
 drivers/net/wireless/marvell/mwifiex/util.c   |  9 ++++++++
 .../wireless/virtual/mac80211_hwsim_main.c    | 19 +++++++++++++---
 net/mac80211/s1g.c                            |  4 ++++
 net/mac80211/tx.c                             |  4 ++++
 net/wireless/nl80211.c                        | 10 +++++----
 net/wireless/pmsr.c                           |  5 +++--
 9 files changed, 76 insertions(+), 9 deletions(-)

-- 
2.50.1 (Apple Git-155)