[PATCH 3/3] Fix PERR frame processing

[Masashi Honma <masashi.honma@gmail.com>]

There are no issues with the PERR processing itself; however, to maintain
consistency with the previous PREQ/PREP code modifications, I will create a new
mesh_path_parse_error_frame() function to separately implement the frame format
validation and the "not supported" check.

Assisted-by: Claude:Sonnet 4.6
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
---
 net/mac80211/mesh.h      |  1 +
 net/mac80211/mesh_hwmp.c | 48 ++++++++++++++++++++++++++++++++++++++--
 net/mac80211/parse.c     |  7 ++++--
 3 files changed, 52 insertions(+), 4 deletions(-)

diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index aba7ef59195a..610c34e35e64 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -319,6 +319,7 @@ void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop);
 void mesh_path_expire(struct ieee80211_sub_if_data *sdata);
 u8 mesh_path_parse_request_frame(const u8 *pos, u8 elen);
 u8 mesh_path_parse_reply_frame(const u8 *pos, u8 elen);
+u8 mesh_path_parse_error_frame(const u8 *pos, u8 elen);
 void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
 			    struct ieee80211_mgmt *mgmt, size_t len);
 struct mesh_path *
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 9f903a2408f7..2a293b771f79 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -62,6 +62,7 @@ static inline u16 u16_field_get(const u8 *preq_elem, int offset, bool ae)
 #define PREP_IE_TARGET_SN(x)	u32_field_get(x, 9, 0)
 
 #define PERR_IE_TTL(x)		(*(x))
+#define PERR_IE_NUMBER_OF_DST(x)	(*(x + 1))
 #define PERR_IE_TARGET_FLAGS(x)	(*(x + 2))
 #define PERR_IE_TARGET_ADDR(x)	(x + 3)
 #define PERR_IE_TARGET_SN(x)	u32_field_get(x, 9, 0)
@@ -968,6 +969,42 @@ u8 mesh_path_parse_reply_frame(const u8 *pos, u8 elen)
 	return 0;
 }
 
+/* IEEE Std 802.11-2016 9.4.2.115 PERR element */
+u8 mesh_path_parse_error_frame(const u8 *pos, u8 elen)
+{
+	u8 number_of_dst;
+	u8 expected_len;
+	const u8 *start;
+	int i;
+
+	number_of_dst = PERR_IE_NUMBER_OF_DST(pos);
+	if (unlikely(number_of_dst < 1 || number_of_dst > 19))
+		return IEEE80211_PARSE_ERR_UNEXPECTED_ELEM;
+
+	start = pos;
+	expected_len = 1 /* Element TTL */ + 1 /* Number of Destinations */;
+	pos += 2;
+
+	for (i = 0; i < number_of_dst; i++) {
+		u8 dst_len;
+
+		if (unlikely(pos - start >= elen))
+			return IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
+
+		dst_len = 1 /* Flags */ + 6 /* Destination Address */ +
+			  4 /* HWMP Sequence Number */ +
+			  (AE_F_SET(pos) ? 6 : 0) /* Destination External Address */ +
+			  2 /* Reason Code */;
+		expected_len += dst_len;
+		pos += dst_len;
+	}
+
+	if (unlikely(elen != expected_len))
+		return IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
+
+	return 0;
+}
+
 void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
 			    struct ieee80211_mgmt *mgmt, size_t len)
 {
@@ -976,6 +1013,7 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
 	u32 path_metric;
 	struct sta_info *sta;
 	u8 target_count;
+	u8 number_of_dst;
 
 	/* need action_code */
 	if (len < IEEE80211_MIN_ACTION_SIZE(mesh_action))
@@ -1026,9 +1064,15 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
 						path_metric);
 	}
 	if (elems->perr) {
-		if (elems->perr_len != 15)
-			/* Right now we support only one destination per PERR */
+		/* Right now we support only one destination per PERR */
+		number_of_dst = PERR_IE_NUMBER_OF_DST(elems->perr);
+		if (number_of_dst != 1)
 			goto free;
+
+		/* Right now we do not support AE (Address Extension) */
+		if (PERR_IE_TARGET_FLAGS(elems->perr) & AE_F)
+			goto free;
+
 		hwmp_perr_frame_process(sdata, mgmt, elems->perr);
 	}
 	if (elems->rann)
diff --git a/net/mac80211/parse.c b/net/mac80211/parse.c
index cdc549055242..dfc326db0471 100644
--- a/net/mac80211/parse.c
+++ b/net/mac80211/parse.c
@@ -561,8 +561,11 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
 			}
 			break;
 		case WLAN_EID_PERR:
-			elems->perr = pos;
-			elems->perr_len = elen;
+			elem_parse_failed = mesh_path_parse_error_frame(pos, elen);
+			if (likely(!elem_parse_failed)) {
+				elems->perr = pos;
+				elems->perr_len = elen;
+			}
 			break;
 		case WLAN_EID_RANN:
 			if (elen >= sizeof(struct ieee80211_rann_ie))
-- 
2.43.0