* [PATCH v9 2/9] wifi: mac80211: Use struct instead of macro for PREP frame
2026-05-29 23:09 [PATCH v9 1/9] wifi: mac80211: Use struct instead of macro for PREQ frame Masashi Honma
@ 2026-05-29 23:09 ` Masashi Honma
2026-05-29 23:09 ` [PATCH v9 3/9] wifi: mac80211: Use struct instead of macro for PERR frame Masashi Honma
` (6 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Masashi Honma @ 2026-05-29 23:09 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Masashi Honma
The existing PREP_IE_* macros access HWMP PREP frame fields via hardcoded
byte offsets. When the AE (Address Extension) flag is set, an additional
6 bytes appear mid-frame, making the offset arithmetic error-prone.
Introduce typed packed C structs to represent the PREP frame layout:
- ieee80211_mesh_hwmp_prep_top: fixed fields before the optional AE
address
- ieee80211_mesh_hwmp_prep_bottom: fields after the optional AE address
Add ieee80211_mesh_hwmp_prep_get_bottom() to locate the bottom struct
correctly based on whether the AE flag is set.
This preparatory refactoring is needed to fix a 2-byte overread of
orig_addr in hwmp_prep_frame_process() when AE is enabled, which is
addressed in a subsequent patch.
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
---
include/linux/ieee80211-mesh.h | 27 ++++++++++++++++++++
net/mac80211/mesh_hwmp.c | 46 ++++++++++++++++------------------
2 files changed, 49 insertions(+), 24 deletions(-)
diff --git a/include/linux/ieee80211-mesh.h b/include/linux/ieee80211-mesh.h
index bf4a544aed00..4ce4e47d6d01 100644
--- a/include/linux/ieee80211-mesh.h
+++ b/include/linux/ieee80211-mesh.h
@@ -53,6 +53,24 @@ struct ieee80211_mesh_hwmp_preq_bottom {
struct ieee80211_mesh_hwmp_preq_target targets[];
} __packed;
+struct ieee80211_mesh_hwmp_prep_top {
+ u8 flags;
+ u8 hopcount;
+ u8 ttl;
+ u8 target_addr[ETH_ALEN];
+ __le32 target_sn;
+
+ /* optional Target External Address */
+ u8 variable[];
+} __packed;
+
+struct ieee80211_mesh_hwmp_prep_bottom {
+ __le32 lifetime;
+ __le32 metric;
+ u8 orig_addr[ETH_ALEN];
+ __le32 orig_sn;
+} __packed;
+
/* Mesh flags */
#define MESH_FLAGS_AE_A4 0x1
#define MESH_FLAGS_AE_A5_A6 0x2
@@ -269,4 +287,13 @@ ieee80211_mesh_hwmp_preq_get_bottom(const u8 *ie)
ieee80211_mesh_preq_prep_ae_enabled(ie) ? ETH_ALEN : 0];
}
+static inline struct ieee80211_mesh_hwmp_prep_bottom *
+ieee80211_mesh_hwmp_prep_get_bottom(const u8 *ie)
+{
+ struct ieee80211_mesh_hwmp_prep_top *top = (void *)ie;
+
+ return (void *)&top->variable[
+ ieee80211_mesh_preq_prep_ae_enabled(ie) ? ETH_ALEN : 0];
+}
+
#endif /* LINUX_IEEE80211_MESH_H */
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 1a6a22b185d9..39b782370df0 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -37,16 +37,6 @@ static inline u16 u16_field_get(const u8 *preq_elem, int offset, bool ae)
/* HWMP IE processing macros */
#define AE_F_SET(x) (*x & AE_F)
-#define PREP_IE_FLAGS(x) (*(x))
-#define PREP_IE_HOPCOUNT(x) (*(x + 1))
-#define PREP_IE_TTL(x) (*(x + 2))
-#define PREP_IE_ORIG_ADDR(x) (AE_F_SET(x) ? x + 27 : x + 21)
-#define PREP_IE_ORIG_SN(x) u32_field_get(x, 27, AE_F_SET(x))
-#define PREP_IE_LIFETIME(x) u32_field_get(x, 13, AE_F_SET(x))
-#define PREP_IE_METRIC(x) u32_field_get(x, 17, AE_F_SET(x))
-#define PREP_IE_TARGET_ADDR(x) (x + 3)
-#define PREP_IE_TARGET_SN(x) u32_field_get(x, 9, 0)
-
#define PERR_IE_TTL(x) (*(x))
#define PERR_IE_TARGET_FLAGS(x) (*(x + 2))
#define PERR_IE_TARGET_ADDR(x) (x + 3)
@@ -419,11 +409,16 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
* so that we can easily use a single function to gather path
* information from both PREQ and PREP frames.
*/
- orig_addr = PREP_IE_TARGET_ADDR(hwmp_ie);
- orig_sn = PREP_IE_TARGET_SN(hwmp_ie);
- orig_lifetime = PREP_IE_LIFETIME(hwmp_ie);
- orig_metric = PREP_IE_METRIC(hwmp_ie);
- hopcount = PREP_IE_HOPCOUNT(hwmp_ie) + 1;
+ struct ieee80211_mesh_hwmp_prep_top *prep_elem_top =
+ (void *)hwmp_ie;
+ struct ieee80211_mesh_hwmp_prep_bottom *prep_elem_bottom =
+ ieee80211_mesh_hwmp_prep_get_bottom(hwmp_ie);
+
+ orig_addr = prep_elem_top->target_addr;
+ orig_sn = le32_to_cpu(prep_elem_top->target_sn);
+ orig_lifetime = le32_to_cpu(prep_elem_bottom->lifetime);
+ orig_metric = le32_to_cpu(prep_elem_bottom->metric);
+ hopcount = prep_elem_top->hopcount + 1;
break;
default:
rcu_read_unlock();
@@ -714,6 +709,9 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
const u8 *prep_elem, u32 metric)
{
struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+ struct ieee80211_mesh_hwmp_prep_top *prep_elem_top = (void *)prep_elem;
+ struct ieee80211_mesh_hwmp_prep_bottom *prep_elem_bottom =
+ ieee80211_mesh_hwmp_prep_get_bottom(prep_elem);
struct mesh_path *mpath;
const u8 *target_addr, *orig_addr;
u8 ttl, hopcount, flags;
@@ -721,9 +719,9 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
u32 target_sn, orig_sn, lifetime;
mhwmp_dbg(sdata, "received PREP from %pM\n",
- PREP_IE_TARGET_ADDR(prep_elem));
+ prep_elem_top->target_addr);
- orig_addr = PREP_IE_ORIG_ADDR(prep_elem);
+ orig_addr = prep_elem_bottom->orig_addr;
if (ether_addr_equal(orig_addr, sdata->vif.addr))
/* destination, no forwarding required */
return;
@@ -731,7 +729,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
if (!ifmsh->mshcfg.dot11MeshForwarding)
return;
- ttl = PREP_IE_TTL(prep_elem);
+ ttl = prep_elem_top->ttl;
if (ttl <= 1) {
sdata->u.mesh.mshstats.dropped_frames_ttl++;
return;
@@ -750,12 +748,12 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
memcpy(next_hop, next_hop_deref_protected(mpath)->sta.addr, ETH_ALEN);
spin_unlock_bh(&mpath->state_lock);
--ttl;
- flags = PREP_IE_FLAGS(prep_elem);
- lifetime = PREP_IE_LIFETIME(prep_elem);
- hopcount = PREP_IE_HOPCOUNT(prep_elem) + 1;
- target_addr = PREP_IE_TARGET_ADDR(prep_elem);
- target_sn = PREP_IE_TARGET_SN(prep_elem);
- orig_sn = PREP_IE_ORIG_SN(prep_elem);
+ flags = prep_elem_top->flags;
+ lifetime = le32_to_cpu(prep_elem_bottom->lifetime);
+ hopcount = prep_elem_top->hopcount + 1;
+ target_addr = prep_elem_top->target_addr;
+ target_sn = le32_to_cpu(prep_elem_top->target_sn);
+ orig_sn = le32_to_cpu(prep_elem_bottom->orig_sn);
mesh_path_sel_frame_tx(MPATH_PREP, flags, orig_addr, orig_sn, 0,
target_addr, target_sn, next_hop, hopcount,
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v9 3/9] wifi: mac80211: Use struct instead of macro for PERR frame
2026-05-29 23:09 [PATCH v9 1/9] wifi: mac80211: Use struct instead of macro for PREQ frame Masashi Honma
2026-05-29 23:09 ` [PATCH v9 2/9] wifi: mac80211: Use struct instead of macro for PREP frame Masashi Honma
@ 2026-05-29 23:09 ` Masashi Honma
2026-05-29 23:09 ` [PATCH v9 4/9] wifi: mac80211: Fix overread in PREQ frame processing Masashi Honma
` (5 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Masashi Honma @ 2026-05-29 23:09 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Masashi Honma
The existing PERR_IE_* macros access HWMP PERR frame fields via hardcoded
byte offsets. Each PERR destination entry contains an optional 6-byte AE
(Address Extension) address followed by a reason code, making offset-based
access error-prone.
Introduce typed packed C structs to represent the PERR frame layout:
- ieee80211_mesh_hwmp_perr: top-level frame containing TTL and
destination count
- ieee80211_mesh_hwmp_perr_dst: per-destination entry with optional AE
address and variable-position reason code
Add ieee80211_mesh_hwmp_perr_get_rcode() to locate the reason code in
each destination entry depending on whether the AE flag is set.
This refactoring makes the PERR processing code consistent with the
struct-based approach adopted for PREQ and PREP in preceding patches.
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
---
include/linux/ieee80211-mesh.h | 62 ++++++++++++++++++++++++++++++++++
net/mac80211/mesh_hwmp.c | 31 +++--------------
2 files changed, 67 insertions(+), 26 deletions(-)
diff --git a/include/linux/ieee80211-mesh.h b/include/linux/ieee80211-mesh.h
index 4ce4e47d6d01..f709263c310b 100644
--- a/include/linux/ieee80211-mesh.h
+++ b/include/linux/ieee80211-mesh.h
@@ -71,6 +71,21 @@ struct ieee80211_mesh_hwmp_prep_bottom {
__le32 orig_sn;
} __packed;
+struct ieee80211_mesh_hwmp_perr_dst {
+ u8 flags;
+ u8 addr[ETH_ALEN];
+ __le32 sn;
+ /* optional Destination External Address */
+ u8 variable[];
+} __packed;
+
+struct ieee80211_mesh_hwmp_perr {
+ u8 ttl;
+ u8 number_of_dst;
+ /* Destinations */
+ u8 variable[];
+} __packed;
+
/* Mesh flags */
#define MESH_FLAGS_AE_A4 0x1
#define MESH_FLAGS_AE_A5_A6 0x2
@@ -296,4 +311,51 @@ ieee80211_mesh_hwmp_prep_get_bottom(const u8 *ie)
ieee80211_mesh_preq_prep_ae_enabled(ie) ? ETH_ALEN : 0];
}
+static inline struct ieee80211_mesh_hwmp_perr_dst *
+ieee80211_mesh_hwmp_perr_get_dst(const u8 *ie, u8 dst_idx)
+{
+ struct ieee80211_mesh_hwmp_perr *perr_ie = (void *)ie;
+ struct ieee80211_mesh_hwmp_perr_dst *dst;
+ u8 *pos = perr_ie->variable;
+ int i;
+
+ for (i = 0; i < dst_idx + 1; i++) {
+ dst = (void *)pos;
+ pos += sizeof(struct ieee80211_mesh_hwmp_perr_dst) +
+ ((dst->flags & AE_F) ? ETH_ALEN : 0)
+ /* Destination External Address */ +
+ 2 /* Reason Code */;
+ }
+
+ return dst;
+}
+
+static inline u8 *
+ieee80211_mesh_hwmp_perr_get_addr(const u8 *ie, u8 dst_idx)
+{
+ struct ieee80211_mesh_hwmp_perr_dst *dst =
+ ieee80211_mesh_hwmp_perr_get_dst(ie, dst_idx);
+
+ return dst->addr;
+}
+
+static inline u32
+ieee80211_mesh_hwmp_perr_get_sn(const u8 *ie, u8 dst_idx)
+{
+ struct ieee80211_mesh_hwmp_perr_dst *dst =
+ ieee80211_mesh_hwmp_perr_get_dst(ie, dst_idx);
+
+ return le32_to_cpu(dst->sn);
+}
+
+static inline u16
+ieee80211_mesh_hwmp_perr_get_rcode(const u8 *ie, u8 dst_idx)
+{
+ struct ieee80211_mesh_hwmp_perr_dst *dst =
+ ieee80211_mesh_hwmp_perr_get_dst(ie, dst_idx);
+
+ return get_unaligned_le16(&dst->variable[
+ (dst->flags & AE_F) ? ETH_ALEN : 0]);
+}
+
#endif /* LINUX_IEEE80211_MESH_H */
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 39b782370df0..378338778a23 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -20,29 +20,7 @@
static void mesh_queue_preq(struct mesh_path *, u8);
-static inline u32 u32_field_get(const u8 *preq_elem, int offset, bool ae)
-{
- if (ae)
- offset += 6;
- return get_unaligned_le32(preq_elem + offset);
-}
-
-static inline u16 u16_field_get(const u8 *preq_elem, int offset, bool ae)
-{
- if (ae)
- offset += 6;
- return get_unaligned_le16(preq_elem + offset);
-}
-
/* HWMP IE processing macros */
-#define AE_F_SET(x) (*x & AE_F)
-
-#define PERR_IE_TTL(x) (*(x))
-#define PERR_IE_TARGET_FLAGS(x) (*(x + 2))
-#define PERR_IE_TARGET_ADDR(x) (x + 3)
-#define PERR_IE_TARGET_SN(x) u32_field_get(x, 9, 0)
-#define PERR_IE_TARGET_RCODE(x) u16_field_get(x, 13, 0)
-
#define MSEC_TO_TU(x) (x*1000/1024)
#define SN_GT(x, y) ((s32)(y - x) < 0)
#define SN_LT(x, y) ((s32)(x - y) < 0)
@@ -774,6 +752,7 @@ static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
const u8 *perr_elem)
{
struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+ struct ieee80211_mesh_hwmp_perr *perr_elem_s = (void *)perr_elem;
struct mesh_path *mpath;
u8 ttl;
const u8 *ta, *target_addr;
@@ -781,15 +760,15 @@ static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
u16 target_rcode;
ta = mgmt->sa;
- ttl = PERR_IE_TTL(perr_elem);
+ ttl = perr_elem_s->ttl;
if (ttl <= 1) {
ifmsh->mshstats.dropped_frames_ttl++;
return;
}
ttl--;
- target_addr = PERR_IE_TARGET_ADDR(perr_elem);
- target_sn = PERR_IE_TARGET_SN(perr_elem);
- target_rcode = PERR_IE_TARGET_RCODE(perr_elem);
+ target_addr = ieee80211_mesh_hwmp_perr_get_addr(perr_elem, 0);
+ target_sn = ieee80211_mesh_hwmp_perr_get_sn(perr_elem, 0);
+ target_rcode = ieee80211_mesh_hwmp_perr_get_rcode(perr_elem, 0);
rcu_read_lock();
mpath = mesh_path_lookup(sdata, target_addr);
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v9 4/9] wifi: mac80211: Fix overread in PREQ frame processing
2026-05-29 23:09 [PATCH v9 1/9] wifi: mac80211: Use struct instead of macro for PREQ frame Masashi Honma
2026-05-29 23:09 ` [PATCH v9 2/9] wifi: mac80211: Use struct instead of macro for PREP frame Masashi Honma
2026-05-29 23:09 ` [PATCH v9 3/9] wifi: mac80211: Use struct instead of macro for PERR frame Masashi Honma
@ 2026-05-29 23:09 ` Masashi Honma
2026-05-29 23:09 ` [PATCH v9 5/9] wifi: mac80211: Fix overread in PREP " Masashi Honma
` (4 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Masashi Honma @ 2026-05-29 23:09 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Masashi Honma
When the AF flag is enabled, hwmp_preq_frame_process() overreads
target_addr by 2 bytes. Since this occurs within the socket buffer, it does
not read across memory boundaries and therefore poses no security risk;
however, we will fix it as a precaution.
In this fix, a new function mesh_path_parse_request_frame() is established
to separate the implementation of frame format validation and the check for
unsupported features. This is intended to facilitate future work when
implementing the currently unsupported parts.
Assisted-by: Claude:Sonnet 4.6
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
---
include/linux/ieee80211-mesh.h | 29 +++++++++++++++++++++++++++++
net/mac80211/mesh_hwmp.c | 12 ++++++++++--
net/mac80211/parse.c | 9 +++++++--
3 files changed, 46 insertions(+), 4 deletions(-)
diff --git a/include/linux/ieee80211-mesh.h b/include/linux/ieee80211-mesh.h
index f709263c310b..8fbd31d9538d 100644
--- a/include/linux/ieee80211-mesh.h
+++ b/include/linux/ieee80211-mesh.h
@@ -358,4 +358,33 @@ ieee80211_mesh_hwmp_perr_get_rcode(const u8 *ie, u8 dst_idx)
(dst->flags & AE_F) ? ETH_ALEN : 0]);
}
+/* IEEE Std 802.11-2016 9.4.2.113 PREQ element */
+static inline bool ieee80211_mesh_preq_size_ok(const u8 *pos, u8 elen)
+{
+ struct ieee80211_mesh_hwmp_preq_bottom *preq_elem_bottom =
+ ieee80211_mesh_hwmp_preq_get_bottom(pos);
+ u8 target_count;
+ int needed;
+
+ /* Check if the element contains flags */
+ needed = sizeof(struct ieee80211_mesh_hwmp_preq_top);
+ if (elen < needed)
+ return false;
+
+ /* Check if the element contains target_count */
+ needed += (ieee80211_mesh_preq_prep_ae_enabled(pos) ? ETH_ALEN : 0)
+ /* Originator External Address */ +
+ sizeof(struct ieee80211_mesh_hwmp_preq_bottom);
+ if (elen < needed)
+ return false;
+
+ target_count = preq_elem_bottom->target_count;
+ /* IEEE Std 802.11-2016 Table 14-10 to 14-16 */
+ if (target_count < 1)
+ return false;
+
+ needed += target_count * sizeof(struct ieee80211_mesh_hwmp_preq_target);
+ return elen == needed;
+}
+
#endif /* LINUX_IEEE80211_MESH_H */
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 378338778a23..ef6eff52f32a 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -929,9 +929,17 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
return;
if (elems->preq) {
- if (elems->preq_len != 37)
- /* Right now we support just 1 destination and no AE */
+ struct ieee80211_mesh_hwmp_preq_bottom *preq_elem_bottom =
+ ieee80211_mesh_hwmp_preq_get_bottom(elems->preq);
+
+ /* Right now we do not support AE (Address Extension) */
+ if (ieee80211_mesh_preq_prep_ae_enabled(elems->preq))
goto free;
+
+ /* Right now we only support 1 target */
+ if (preq_elem_bottom->target_count != 1)
+ goto free;
+
path_metric = hwmp_route_info_get(sdata, mgmt, elems->preq,
MPATH_PREQ);
if (path_metric)
diff --git a/net/mac80211/parse.c b/net/mac80211/parse.c
index 8b30e361b622..3d441ff9593d 100644
--- a/net/mac80211/parse.c
+++ b/net/mac80211/parse.c
@@ -563,8 +563,13 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
elems->awake_window = (void *)pos;
break;
case WLAN_EID_PREQ:
- elems->preq = pos;
- elems->preq_len = elen;
+ if (ieee80211_mesh_preq_size_ok(pos, elen)) {
+ elems->preq = pos;
+ elems->preq_len = elen;
+ } else {
+ elem_parse_failed =
+ IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
+ }
break;
case WLAN_EID_PREP:
elems->prep = pos;
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v9 5/9] wifi: mac80211: Fix overread in PREP frame processing
2026-05-29 23:09 [PATCH v9 1/9] wifi: mac80211: Use struct instead of macro for PREQ frame Masashi Honma
` (2 preceding siblings ...)
2026-05-29 23:09 ` [PATCH v9 4/9] wifi: mac80211: Fix overread in PREQ frame processing Masashi Honma
@ 2026-05-29 23:09 ` Masashi Honma
2026-05-29 23:09 ` [PATCH v9 6/9] wifi: mac80211: Fix PERR " Masashi Honma
` (3 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Masashi Honma @ 2026-05-29 23:09 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Masashi Honma
When the AF flag is enabled, hwmp_prep_frame_process() overreads orig_addr
by 2 bytes. Since this occurs within the socket buffer, it does not read
across memory boundaries and therefore poses no security risk; however, we
will fix it as a precaution.
In this fix, a new function mesh_path_parse_reply_frame() is established to
separate the implementation of frame format validation and the check for
unsupported features. This is intended to facilitate future work when
implementing the currently unsupported parts.
Assisted-by: Claude:Sonnet 4.6
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
---
include/linux/ieee80211-mesh.h | 16 ++++++++++++++++
net/mac80211/mesh_hwmp.c | 4 ++--
net/mac80211/parse.c | 9 +++++++--
3 files changed, 25 insertions(+), 4 deletions(-)
diff --git a/include/linux/ieee80211-mesh.h b/include/linux/ieee80211-mesh.h
index 8fbd31d9538d..482ac0c6d759 100644
--- a/include/linux/ieee80211-mesh.h
+++ b/include/linux/ieee80211-mesh.h
@@ -387,4 +387,20 @@ static inline bool ieee80211_mesh_preq_size_ok(const u8 *pos, u8 elen)
return elen == needed;
}
+/* IEEE Std 802.11-2016 9.4.2.114 PREP element */
+static inline bool ieee80211_mesh_prep_size_ok(const u8 *pos, u8 elen)
+{
+ u8 needed;
+
+ /* Check if the element contains flags */
+ needed = sizeof(struct ieee80211_mesh_hwmp_prep_top);
+ if (elen < needed)
+ return false;
+
+ needed += (ieee80211_mesh_preq_prep_ae_enabled(pos) ? ETH_ALEN : 0)
+ /* Target External Address */ +
+ sizeof(struct ieee80211_mesh_hwmp_prep_bottom);
+ return elen == needed;
+}
+
#endif /* LINUX_IEEE80211_MESH_H */
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index ef6eff52f32a..f07e57d5568a 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -947,8 +947,8 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
path_metric);
}
if (elems->prep) {
- if (elems->prep_len != 31)
- /* Right now we support no AE */
+ /* Right now we do not support AE (Address Extension) */
+ if (ieee80211_mesh_preq_prep_ae_enabled(elems->prep))
goto free;
path_metric = hwmp_route_info_get(sdata, mgmt, elems->prep,
MPATH_PREP);
diff --git a/net/mac80211/parse.c b/net/mac80211/parse.c
index 3d441ff9593d..97508b141b8c 100644
--- a/net/mac80211/parse.c
+++ b/net/mac80211/parse.c
@@ -572,8 +572,13 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
}
break;
case WLAN_EID_PREP:
- elems->prep = pos;
- elems->prep_len = elen;
+ if (ieee80211_mesh_prep_size_ok(pos, elen)) {
+ elems->prep = pos;
+ elems->prep_len = elen;
+ } else {
+ elem_parse_failed =
+ IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
+ }
break;
case WLAN_EID_PERR:
elems->perr = pos;
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v9 6/9] wifi: mac80211: Fix PERR frame processing
2026-05-29 23:09 [PATCH v9 1/9] wifi: mac80211: Use struct instead of macro for PREQ frame Masashi Honma
` (3 preceding siblings ...)
2026-05-29 23:09 ` [PATCH v9 5/9] wifi: mac80211: Fix overread in PREP " Masashi Honma
@ 2026-05-29 23:09 ` Masashi Honma
2026-05-29 23:09 ` [PATCH v9 7/9] Add KUnit test for ieee80211_mesh_preq_size_ok Masashi Honma
` (2 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Masashi Honma @ 2026-05-29 23:09 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Masashi Honma
There are no issues with the PERR processing itself; however, to maintain
consistency with the previous PREQ/PREP code modifications, I will create a
new mesh_path_parse_error_frame() function to separately implement the
frame format validation and the "not supported" check.
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
---
include/linux/ieee80211-mesh.h | 36 ++++++++++++++++++++++++++++++++++
net/mac80211/mesh_hwmp.c | 18 +++++++++++++++--
net/mac80211/parse.c | 9 +++++++--
3 files changed, 59 insertions(+), 4 deletions(-)
diff --git a/include/linux/ieee80211-mesh.h b/include/linux/ieee80211-mesh.h
index 482ac0c6d759..7eb15834531c 100644
--- a/include/linux/ieee80211-mesh.h
+++ b/include/linux/ieee80211-mesh.h
@@ -403,4 +403,40 @@ static inline bool ieee80211_mesh_prep_size_ok(const u8 *pos, u8 elen)
return elen == needed;
}
+/* IEEE Std 802.11-2016 9.4.2.115 PERR element */
+static inline bool ieee80211_mesh_perr_size_ok(const u8 *pos, u8 elen)
+{
+ struct ieee80211_mesh_hwmp_perr *perr_elem = (void *)pos;
+ const u8 *start = pos;
+ u8 number_of_dst;
+ int needed;
+ int i;
+
+ needed = sizeof(struct ieee80211_mesh_hwmp_perr);
+
+ /* Check if the element contains number of dst */
+ if (elen < needed)
+ return false;
+
+ pos += sizeof(struct ieee80211_mesh_hwmp_perr);
+ number_of_dst = perr_elem->number_of_dst;
+
+ for (i = 0; i < number_of_dst; i++) {
+ struct ieee80211_mesh_hwmp_perr_dst *dst = (void *)pos;
+ u8 dst_len = sizeof(struct ieee80211_mesh_hwmp_perr_dst);
+
+ /* Check if the element contains flags */
+ if (elen < pos - start + dst_len)
+ return false;
+
+ dst_len += ((dst->flags & AE_F) ? ETH_ALEN : 0)
+ /* Destination External Address */ +
+ 2 /* Reason Code */;
+ needed += dst_len;
+ pos += dst_len;
+ }
+
+ return elen == needed;
+}
+
#endif /* LINUX_IEEE80211_MESH_H */
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index f07e57d5568a..84903737271d 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -957,9 +957,23 @@ void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
path_metric);
}
if (elems->perr) {
- if (elems->perr_len != 15)
- /* Right now we support only one destination per PERR */
+ struct ieee80211_mesh_hwmp_perr *perr_elem =
+ (struct ieee80211_mesh_hwmp_perr *)elems->perr;
+ int i;
+
+ /* Right now we support only one destination per PERR */
+ if (perr_elem->number_of_dst != 1)
goto free;
+
+ /* Right now we do not support AE (Address Extension) */
+ for (i = 0; i < perr_elem->number_of_dst; i++) {
+ struct ieee80211_mesh_hwmp_perr_dst *dst =
+ ieee80211_mesh_hwmp_perr_get_dst(elems->perr, i);
+
+ if (dst->flags & AE_F)
+ goto free;
+ }
+
hwmp_perr_frame_process(sdata, mgmt, elems->perr);
}
if (elems->rann)
diff --git a/net/mac80211/parse.c b/net/mac80211/parse.c
index 97508b141b8c..c44e81a2f80d 100644
--- a/net/mac80211/parse.c
+++ b/net/mac80211/parse.c
@@ -581,8 +581,13 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
}
break;
case WLAN_EID_PERR:
- elems->perr = pos;
- elems->perr_len = elen;
+ if (ieee80211_mesh_perr_size_ok(pos, elen)) {
+ elems->perr = pos;
+ elems->perr_len = elen;
+ } else {
+ elem_parse_failed =
+ IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;
+ }
break;
case WLAN_EID_RANN:
if (elen >= sizeof(struct ieee80211_rann_ie))
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v9 7/9] Add KUnit test for ieee80211_mesh_preq_size_ok
2026-05-29 23:09 [PATCH v9 1/9] wifi: mac80211: Use struct instead of macro for PREQ frame Masashi Honma
` (4 preceding siblings ...)
2026-05-29 23:09 ` [PATCH v9 6/9] wifi: mac80211: Fix PERR " Masashi Honma
@ 2026-05-29 23:09 ` Masashi Honma
2026-05-29 23:09 ` [PATCH v9 8/9] Add KUnit test for ieee80211_mesh_prep_size_ok Masashi Honma
2026-05-29 23:09 ` [PATCH v9 9/9] Add KUnit test for ieee80211_mesh_perr_size_ok Masashi Honma
7 siblings, 0 replies; 9+ messages in thread
From: Masashi Honma @ 2026-05-29 23:09 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Masashi Honma
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
---
net/mac80211/tests/elems.c | 105 +++++++++++++++++++++++++++++++++++++
1 file changed, 105 insertions(+)
diff --git a/net/mac80211/tests/elems.c b/net/mac80211/tests/elems.c
index 1039794a0183..576ba746a526 100644
--- a/net/mac80211/tests/elems.c
+++ b/net/mac80211/tests/elems.c
@@ -9,6 +9,94 @@
MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING");
+static const struct mesh_preq_parse_test_case {
+ const char *desc;
+ u8 len;
+ bool ae_enabled;
+ u8 target_count;
+ bool result;
+} mesh_preq_parse_cases[] = {
+ {
+ .desc = "shorter than header",
+ .len = 16,
+ .ae_enabled = false,
+ .target_count = 1,
+ .result = false,
+ },
+ {
+ .desc = "too short non AE, target count is not included",
+ .len = 29,
+ .ae_enabled = false,
+ .target_count = 1,
+ .result = false,
+ },
+ {
+ .desc = "too short non AE, target count is 1",
+ .len = 36,
+ .ae_enabled = false,
+ .target_count = 1,
+ .result = false,
+ },
+ {
+ .desc = "too short AE, target count is not included",
+ .len = 35,
+ .ae_enabled = true,
+ .target_count = 1,
+ .result = false,
+ },
+ {
+ .desc = "too short AE, target count is 1",
+ .len = 42,
+ .ae_enabled = true,
+ .target_count = 1,
+ .result = false,
+ },
+ {
+ .desc = "target count is zero",
+ .len = 26,
+ .ae_enabled = false,
+ .target_count = 0,
+ .result = false,
+ },
+ {
+ .desc = "target count is 21",
+ .len = 255,
+ .ae_enabled = false,
+ .target_count = 21,
+ .result = false,
+ },
+ {
+ .desc = "non AE, target count is 1",
+ .len = 37,
+ .ae_enabled = false,
+ .target_count = 1,
+ .result = true,
+ },
+ {
+ .desc = "non AE, target count is 20",
+ .len = 246,
+ .ae_enabled = false,
+ .target_count = 20,
+ .result = true,
+ },
+ {
+ .desc = "AE, target count is 1",
+ .len = 43,
+ .ae_enabled = true,
+ .target_count = 1,
+ .result = true,
+ },
+ {
+ .desc = "AE, target count is 20",
+ .len = 252,
+ .ae_enabled = true,
+ .target_count = 20,
+ .result = true,
+ },
+};
+
+KUNIT_ARRAY_PARAM_DESC(mesh_preq_parse, mesh_preq_parse_cases, desc);
+
static void mle_defrag(struct kunit *test)
{
struct ieee80211_elems_parse_params parse_params = {
@@ -91,8 +179,25 @@ static void mle_defrag(struct kunit *test)
kfree_skb(skb);
}
+static void mesh_preq_parse(struct kunit *test)
+{
+ const struct mesh_preq_parse_test_case *params = test->param_value;
+ u8 data[64] = {};
+ struct ieee80211_mesh_hwmp_preq_top *top = (void *)data;
+ struct ieee80211_mesh_hwmp_preq_bottom *bottom;
+
+ top->flags = params->ae_enabled ? AE_F : 0;
+ bottom = ieee80211_mesh_hwmp_preq_get_bottom(data);
+ bottom->target_count = params->target_count;
+
+ KUNIT_EXPECT_EQ(test,
+ ieee80211_mesh_preq_size_ok(data, params->len),
+ params->result);
+}
+
static struct kunit_case element_parsing_test_cases[] = {
KUNIT_CASE(mle_defrag),
+ KUNIT_CASE_PARAM(mesh_preq_parse, mesh_preq_parse_gen_params),
{}
};
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v9 8/9] Add KUnit test for ieee80211_mesh_prep_size_ok
2026-05-29 23:09 [PATCH v9 1/9] wifi: mac80211: Use struct instead of macro for PREQ frame Masashi Honma
` (5 preceding siblings ...)
2026-05-29 23:09 ` [PATCH v9 7/9] Add KUnit test for ieee80211_mesh_preq_size_ok Masashi Honma
@ 2026-05-29 23:09 ` Masashi Honma
2026-05-29 23:09 ` [PATCH v9 9/9] Add KUnit test for ieee80211_mesh_perr_size_ok Masashi Honma
7 siblings, 0 replies; 9+ messages in thread
From: Masashi Honma @ 2026-05-29 23:09 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Masashi Honma
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
---
net/mac80211/tests/elems.c | 53 ++++++++++++++++++++++++++++++++++++++
1 file changed, 53 insertions(+)
diff --git a/net/mac80211/tests/elems.c b/net/mac80211/tests/elems.c
index 576ba746a526..b96424d5d025 100644
--- a/net/mac80211/tests/elems.c
+++ b/net/mac80211/tests/elems.c
@@ -97,6 +97,46 @@ static const struct mesh_preq_parse_test_case {
KUNIT_ARRAY_PARAM_DESC(mesh_preq_parse, mesh_preq_parse_cases, desc);
+static const struct mesh_prep_parse_test_case {
+ const char *desc;
+ u8 len;
+ bool ae_enabled;
+ bool result;
+} mesh_prep_parse_cases[] = {
+ {
+ .desc = "shorter than header",
+ .len = 12,
+ .ae_enabled = false,
+ .result = false,
+ },
+ {
+ .desc = "non AE short",
+ .len = 30,
+ .ae_enabled = false,
+ .result = false,
+ },
+ {
+ .desc = "non AE",
+ .len = 31,
+ .ae_enabled = false,
+ .result = true,
+ },
+ {
+ .desc = "AE short",
+ .len = 36,
+ .ae_enabled = true,
+ .result = false,
+ },
+ {
+ .desc = "AE",
+ .len = 37,
+ .ae_enabled = true,
+ .result = true,
+ },
+};
+
+KUNIT_ARRAY_PARAM_DESC(mesh_prep_parse, mesh_prep_parse_cases, desc);
+
static void mle_defrag(struct kunit *test)
{
struct ieee80211_elems_parse_params parse_params = {
@@ -195,9 +235,22 @@ static void mesh_preq_parse(struct kunit *test)
params->result);
}
+static void mesh_prep_parse(struct kunit *test)
+{
+ const struct mesh_prep_parse_test_case *params = test->param_value;
+ u8 data[64] = {};
+ struct ieee80211_mesh_hwmp_prep_top *top = (void *)data;
+ top->flags = params->ae_enabled ? AE_F : 0;
+
+ KUNIT_EXPECT_EQ(test,
+ ieee80211_mesh_prep_size_ok(data, params->len),
+ params->result);
+}
+
static struct kunit_case element_parsing_test_cases[] = {
KUNIT_CASE(mle_defrag),
KUNIT_CASE_PARAM(mesh_preq_parse, mesh_preq_parse_gen_params),
+ KUNIT_CASE_PARAM(mesh_prep_parse, mesh_prep_parse_gen_params),
{}
};
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v9 9/9] Add KUnit test for ieee80211_mesh_perr_size_ok
2026-05-29 23:09 [PATCH v9 1/9] wifi: mac80211: Use struct instead of macro for PREQ frame Masashi Honma
` (6 preceding siblings ...)
2026-05-29 23:09 ` [PATCH v9 8/9] Add KUnit test for ieee80211_mesh_prep_size_ok Masashi Honma
@ 2026-05-29 23:09 ` Masashi Honma
7 siblings, 0 replies; 9+ messages in thread
From: Masashi Honma @ 2026-05-29 23:09 UTC (permalink / raw)
To: linux-wireless; +Cc: johannes, Masashi Honma
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
---
net/mac80211/tests/elems.c | 124 +++++++++++++++++++++++++++++++++++++
1 file changed, 124 insertions(+)
diff --git a/net/mac80211/tests/elems.c b/net/mac80211/tests/elems.c
index b96424d5d025..4b13a5aad875 100644
--- a/net/mac80211/tests/elems.c
+++ b/net/mac80211/tests/elems.c
@@ -137,6 +137,109 @@ static const struct mesh_prep_parse_test_case {
KUNIT_ARRAY_PARAM_DESC(mesh_prep_parse, mesh_prep_parse_cases, desc);
+static const struct mesh_perr_parse_test_case {
+ const char *desc;
+ u8 len;
+ u8 number_of_dst;
+ int ae_enabled_idx;
+ bool result;
+} mesh_perr_parse_cases[] = {
+ {
+ .desc = "shorter than header",
+ .len = 1,
+ .number_of_dst = 1,
+ .ae_enabled_idx = -1,
+ .result = false,
+ },
+ {
+ .desc = "number_of_dst is 0",
+ .len = 2,
+ .number_of_dst = 0,
+ .ae_enabled_idx = -1,
+ .result = true,
+ },
+ {
+ .desc = "number_of_dst is 20",
+ .len = 255,
+ .number_of_dst = 20,
+ .ae_enabled_idx = -1,
+ .result = false,
+ },
+ {
+ .desc = "number_of_dst is 1, non AE, short",
+ .len = 14,
+ .number_of_dst = 1,
+ .ae_enabled_idx = -1,
+ .result = false,
+ },
+ {
+ .desc = "number_of_dst is 1, non AE",
+ .len = 15,
+ .number_of_dst = 1,
+ .ae_enabled_idx = -1,
+ .result = true,
+ },
+ {
+ .desc = "number_of_dst is 1, non AE, extra short dst header",
+ .len = 25,
+ .number_of_dst = 1,
+ .ae_enabled_idx = -1,
+ .result = false,
+ },
+ {
+ .desc = "number_of_dst is 1, non AE, extra dst header",
+ .len = 26,
+ .number_of_dst = 1,
+ .ae_enabled_idx = -1,
+ .result = false,
+ },
+ {
+ .desc = "number_of_dst is 1, AE, short",
+ .len = 20,
+ .number_of_dst = 1,
+ .ae_enabled_idx = 0,
+ .result = false,
+ },
+ {
+ .desc = "number_of_dst is 1, AE",
+ .len = 21,
+ .number_of_dst = 1,
+ .ae_enabled_idx = 0,
+ .result = true,
+ },
+ {
+ .desc = "number_of_dst is 19, non AE, short",
+ .len = 2 + 13 * 19 - 1,
+ .number_of_dst = 19,
+ .ae_enabled_idx = -1,
+ .result = false,
+ },
+ {
+ .desc = "number_of_dst is 19, non AE",
+ .len = 2 + 13 * 19,
+ .number_of_dst = 19,
+ .ae_enabled_idx = -1,
+ .result = true,
+ },
+ {
+ .desc = "number_of_dst is 19, AE, short",
+ .len = 2 + 13 * 19 + 6 - 1,
+ .number_of_dst = 19,
+ .ae_enabled_idx = 18,
+ .result = false,
+ },
+ {
+ .desc = "number_of_dst is 19, AE",
+ .len = 2 + 13 * 19 + 6,
+ .number_of_dst = 19,
+ .ae_enabled_idx = 18,
+ .result = true,
+ },
+};
+
+KUNIT_ARRAY_PARAM_DESC(mesh_perr_parse, mesh_perr_parse_cases, desc);
+
+
static void mle_defrag(struct kunit *test)
{
struct ieee80211_elems_parse_params parse_params = {
@@ -247,10 +350,31 @@ static void mesh_prep_parse(struct kunit *test)
params->result);
}
+static void mesh_perr_parse(struct kunit *test)
+{
+ const struct mesh_perr_parse_test_case *params = test->param_value;
+ u8 data[256] = {};
+ struct ieee80211_mesh_hwmp_perr *perr = (void *)data;
+
+ perr->number_of_dst = params->number_of_dst;
+ if (params->ae_enabled_idx > -1) {
+ struct ieee80211_mesh_hwmp_perr_dst *dst =
+ ieee80211_mesh_hwmp_perr_get_dst(
+ data, params->ae_enabled_idx);
+
+ dst->flags = AE_F;
+ }
+
+ KUNIT_EXPECT_EQ(test,
+ ieee80211_mesh_perr_size_ok(data, params->len),
+ params->result);
+}
+
static struct kunit_case element_parsing_test_cases[] = {
KUNIT_CASE(mle_defrag),
KUNIT_CASE_PARAM(mesh_preq_parse, mesh_preq_parse_gen_params),
KUNIT_CASE_PARAM(mesh_prep_parse, mesh_prep_parse_gen_params),
+ KUNIT_CASE_PARAM(mesh_perr_parse, mesh_perr_parse_gen_params),
{}
};
--
2.43.0
^ permalink raw reply related [flat|nested] 9+ messages in thread