Re: [PATCH 0/8] wifi: fix PMSR lifetime and frame validation issues

[Enderaoe Lyther]

Hi Johannes,

Thanks for the reminder. They should never be a patchset. Patch 3/8 is with
the Intel maintainers, and 4/8 is applied. I'll send the remaining patches
individually after rebasing each one.

- 5/8 (probe-response countdown): cfg80211 already bounds a nonzero offset
  so original out-of-bounds explanation was totally wrong. But
  zero-initialized probe-response offsets are treated as valid, which
  corrupts resp->data[0]. The v2 skips zero offsets instead.

- 6/8 (S1G TWT): added a guard before the driver callback, with Lachlan
  and Lorenzo copied, sent to wireless-next.

- 7/8 (mwifiex action frame): will use IEEE80211_MIN_ACTION_SIZE() and go
  to the mwifiex maintainers.

Regards,
Zhao

On Wed, 22 Jul 2026 16:37:55 +0200, Johannes Berg
<johannes@xxxxxxxxxxxxxxxx> wrote:
> On Tue, 2026-07-21 at 18:00 +0200, Johannes Berg wrote:
> >
> > > wifi: mac80211: validate probe response countdown offsets
> >
> > I think this one is falling into a typical LLM pattern patching trap, it
> > describes [0] as being out-of-bounds for some allocated data, and
> > neglects that the offsets have already been checked by cfg80211. Please
> > describe more why it's actually an issue beyond "there's a similar
> > pattern elsewhere".
> >
> > > wifi: mac80211: validate S1G TWT params before driver setup
> >
> > I don't know about this, you should probably resend it. Anyway I'm not
> > loosing sleep over it since there's no driver with the callback, tracing
> > is mostly not enabled, and while a potential 12 bytes OOB read at the
> > end of the SKB is a bug, it's not a very important one since there
> > should be stuff there anyway.
> >
> > > wifi: mwifiex: validate action frame fixed fields
> >
> > Francesco should look at that - again, sending it all together makes
> > this really hard - but it seems to me it should use MIN_ACTION_SIZE()?
>
> Also in addition - please resend these, the s1g should go also to
> Lachlan I think who wrote it, and I don't think anyone is paying
> attention to this patchset :)
>
> johannes