Re: [PATCH 1/3] Fix overread in PREQ frame processing

[Johannes Berg <johannes@sipsolutions.net>]

On Sat, 2026-05-09 at 07:59 +0900, Masashi Honma wrote:
>  
> +/* IEEE Std 802.11-2016 9.4.2.113 PREQ element */
> +u8 mesh_path_parse_request_frame(const u8 *pos, u8 elen)
> +{
> +	u8 target_count;
> +	u8 expected_len;
> +
> +	target_count = PREQ_IE_TARGET_COUNT(pos);
> +	if (unlikely(target_count < 1 || target_count > 20))
> +		return IEEE80211_PARSE_ERR_UNEXPECTED_ELEM;

not sure the likely/unlikely really is worth anything there - we don't
process *that* many frames.

> +
> +	expected_len = 1 /* Flags */ + 1 /* Hop Count */ + 1 /* Element TTL */ +
> +		       4 /* Path Discovery ID */ +
> +		       6 /* Originator Mesh STA Address */ +
> +		       4 /* Originator HWMP Sequence Number */ +
> +		       (AE_F_SET(pos) ? 6 : 0) /* Originator External Address */ +
> +		       4 /* Lifetime */ + 4 /* Metric */ + 1 + /* Target Count */ +
> +		       target_count * (1 /* Per Target Flags */ +
> +		       6 /* Target Address */ + 4 /* Target HWMP Sequence Number */);
> +	if (unlikely(elen != expected_len))
> +		return IEEE80211_PARSE_ERR_BAD_ELEM_SIZE;

I think there's a case to be made for doing this like many others, in an
inline in ieee80211-mesh.h, and calling it ..._size_ok() with a bool
return.

> +++ b/net/mac80211/parse.c
> @@ -547,8 +547,11 @@ _ieee802_11_parse_elems_full(struct ieee80211_elems_parse_params *params,
>  				elems->awake_window = (void *)pos;
>  			break;
>  		case WLAN_EID_PREQ:
> -			elems->preq = pos;
> -			elems->preq_len = elen;
> +			elem_parse_failed = mesh_path_parse_request_frame(pos, elen);
> +			if (likely(!elem_parse_failed)) {

that would also fix the build issue here if mesh isn't compiled in.

(and also here, not sure about likely/unlikely, doesn't really seem
worth it, and under attack maybe the failure becomes likely?)

johannes