wifi: cfg80211: validate PMSR measurement type data

PMSR request parsing accepts missing or duplicated measurement type
entries in NL80211_PMSR_REQ_ATTR_DATA.

Track whether one measurement type was already provided, reject a
second one immediately, and return an error if the request data block
contains no measurement type at all.

Fixes: 9bb7e0f24e7e7 ("cfg80211: add peer measurement with FTM initiator API")
Assisted-by: Codex:gpt-5.5
Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260612133656.92900-2-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 2c8db33d9c30981a0d0795ed25c3ddbeea9cb445..4962456fda30e6962827a505f89b35a4e17335f9 100644 (file)
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -310,6 +310,7 @@ static int pmsr_parse_peer(struct cfg80211_registered_device *rdev,
 {
        struct nlattr *tb[NL80211_PMSR_PEER_ATTR_MAX + 1];
        struct nlattr *req[NL80211_PMSR_REQ_ATTR_MAX + 1];
+       bool have_measurement_type = false;
        struct nlattr *treq;
        int err, rem;
 
@@ -376,6 +377,14 @@ static int pmsr_parse_peer(struct cfg80211_registered_device *rdev,
        }
 
        nla_for_each_nested(treq, req[NL80211_PMSR_REQ_ATTR_DATA], rem) {
+               if (have_measurement_type) {
+                       NL_SET_ERR_MSG_ATTR(info->extack, treq,
+                                           "multiple measurement types in request data");
+                       return -EINVAL;
+               }
+
+               have_measurement_type = true;
+
                switch (nla_type(treq)) {
                case NL80211_PMSR_TYPE_FTM:
                        err = pmsr_parse_ftm(rdev, treq, out, info);
@@ -385,10 +394,16 @@ static int pmsr_parse_peer(struct cfg80211_registered_device *rdev,
                                            "unsupported measurement type");
                        err = -EINVAL;
                }
+               if (err)
+                       return err;
        }
 
-       if (err)
-               return err;
+       if (!have_measurement_type) {
+               NL_SET_ERR_MSG_ATTR(info->extack,
+                                   req[NL80211_PMSR_REQ_ATTR_DATA],
+                                   "missing measurement type in request data");
+               return -EINVAL;
+       }
 
        return 0;
 }