Re: [PATCH 0/8] wifi: fix PMSR lifetime and frame validation issues

[Lachlan Hodges]

On Wed, Jul 22, 2026 at 04:37:55PM +0200, Johannes Berg wrote:
> On Tue, 2026-07-21 at 18:00 +0200, Johannes Berg wrote:
> > 
> > >   wifi: mac80211: validate probe response countdown offsets
> > 
> > I think this one is falling into a typical LLM pattern patching trap, it
> > describes [0] as being out-of-bounds for some allocated data, and
> > neglects that the offsets have already been checked by cfg80211. Please
> > describe more why it's actually an issue beyond "there's a similar
> > pattern elsewhere".
> > 
> > >   wifi: mac80211: validate S1G TWT params before driver setup
> > 
> > I don't know about this, you should probably resend it. Anyway I'm not
> > loosing sleep over it since there's no driver with the callback, tracing
> > is mostly not enabled, and while a potential 12 bytes OOB read at the
> > end of the SKB is a bug, it's not a very important one since there
> > should be stuff there anyway.
> > 
> > >   wifi: mwifiex: validate action frame fixed fields
> > 
> > Francesco should look at that - again, sending it all together makes
> > this really hard - but it seems to me it should use MIN_ACTION_SIZE()?
> 
> Also in addition - please resend these, the s1g should go also to
> Lachlan I think who wrote it, and I don't think anyone is paying
> attention to this patchset :)

The twt stuff has been in for a while and was added by Lorenzo [1]. I'm
not sure why it sits in the s1g.c file, I assume because it was first
added to the standard for S1G then expanded to other standards? Might
be worth moving all these to a separate twt.c file (I can if you think
it's worth it).

[1] https://lore.kernel.org/all/257512f2e22ba42b9f2624942a128dd8f141de4b.1629741512.git.lorenzo@xxxxxxxxxx/

lachlan