wifi: cfg80211: reject empty PMSR peer lists

A PMSR request with an empty peers array is not a useful request and
weakens the cfg80211-to-driver contract by allowing start_pmsr() with
no target peer.

Reject empty peer lists before allocating the request object or calling
into the driver.

Fixes: 9bb7e0f24e7e7 ("cfg80211: add peer measurement with FTM initiator API")
Assisted-by: Codex:gpt-5.5
Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Link: https://patch.msgid.link/20260612133717.93783-2-enderaoelyther@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/wireless/pmsr.c b/net/wireless/pmsr.c
index 34ecbc6644a36cc5b75a067a3e60d8879a3aa6f7..34c3625f7fd5e51d34bb4c6ad6f9b0651ad231c6 100644 (file)
--- a/net/wireless/pmsr.c
+++ b/net/wireless/pmsr.c
@@ -444,6 +444,11 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info)
                }
        }
 
+       if (!count) {
+               NL_SET_ERR_MSG_ATTR(info->extack, peers, "No peers specified");
+               return -EINVAL;
+       }
+
        req = kzalloc_flex(*req, peers, count);
        if (!req)
                return -ENOMEM;