wifi: iwlwifi: mvm: fix sched scan IE sizing

Scheduled scan built the probe request before iwl_mvm_scan_fits(),
so oversized IEs could be copied into the fixed preq buffer before
length validation. Move iwl_mvm_build_scan_probe() after the fits
check.

Also advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len()
so userspace limits account for driver-inserted DS/TPC bytes.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Link: https://patch.msgid.link/20260714141909.53d2722c79e7.Iebb922efa6173c92f14cd8aa8b4e7f372c0a0fb7@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index f4f4446bef54285b11a2cb1930e7e0585e7cd918..3e73a6195fd9b3b6a59b7b5b313298e03c722512 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -625,9 +625,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
        hw->wiphy->max_sched_scan_reqs = 1;
        hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
        hw->wiphy->max_match_sets = iwl_umac_scan_get_max_profiles(mvm->fw);
-       /* we create the 802.11 header and zero length SSID IE. */
-       hw->wiphy->max_sched_scan_ie_len =
-               SCAN_OFFLOAD_PROBE_REQ_SIZE - 24 - 2;
+       hw->wiphy->max_sched_scan_ie_len = iwl_mvm_max_scan_ie_len(mvm);
        hw->wiphy->max_sched_scan_plans = IWL_MAX_SCHED_SCAN_PLANS;
        hw->wiphy->max_sched_scan_plan_interval = U16_MAX;
 

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index 42f9d9a713b8804f49127f4658c54de92dffcc12..3831b3c27e0f374cb433408a5df6be147307b912 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -3144,8 +3144,6 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
        if (ret)
                return ret;
 
-       iwl_mvm_build_scan_probe(mvm, vif, ies, &params);
-
        /* for 6 GHZ band only PSC channels need to be added */
        for (i = 0; i < params.n_channels; i++) {
                struct ieee80211_channel *channel = params.channels[i];
@@ -3179,6 +3177,8 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
                goto out;
        }
 
+       iwl_mvm_build_scan_probe(mvm, vif, ies, &params);
+
        uid = iwl_mvm_build_scan_cmd(mvm, vif, &hcmd, &params, type);
        if (uid < 0) {
                ret = uid;