mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-29 22:10:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

wifi: mac80211: Use struct instead of macro for PREP frame

Browse Source 
The existing PREP_IE_* macros access HWMP PREP frame fields via hardcoded
byte offsets. When the AE (Address Extension) flag is set, an additional
6 bytes appear mid-frame, making the offset arithmetic error-prone.

Introduce typed packed C structs to represent the PREP frame layout:
  - ieee80211_mesh_hwmp_prep_top: fixed fields before the optional AE
    address
  - ieee80211_mesh_hwmp_prep_bottom: fields after the optional AE address

Add ieee80211_mesh_hwmp_prep_get_bottom() to locate the bottom struct
correctly based on whether the AE flag is set.

This preparatory refactoring is needed to fix a 2-byte overread of
orig_addr in hwmp_prep_frame_process() when AE is enabled, which is
addressed in a subsequent patch.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
Link: https://patch.msgid.link/20260529230952.124754-2-masashi.honma@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Masashi Honma
2026-05-30 08:09:44 +09:00
committed by Johannes Berg
parent 4ac20bd40b
commit a91c65cb99
2 changed files with 49 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
include/linux/ieee80211-mesh.h
View File

@@ -53,6 +53,24 @@ struct ieee80211_mesh_hwmp_preq_bottom {
struct ieee80211_mesh_hwmp_preq_target targets[]; struct ieee80211_mesh_hwmp_preq_target targets[];
} __packed; } __packed;
struct ieee80211_mesh_hwmp_prep_top {
u8 flags;
u8 hopcount;
u8 ttl;
u8 target_addr[ETH_ALEN];
__le32 target_sn;
/* optional Target External Address */
u8 variable[];
} __packed;
struct ieee80211_mesh_hwmp_prep_bottom {
__le32 lifetime;
__le32 metric;
u8 orig_addr[ETH_ALEN];
__le32 orig_sn;
} __packed;
/* Mesh flags */ /* Mesh flags */
#define MESH_FLAGS_AE_A4 0x1 #define MESH_FLAGS_AE_A4 0x1
#define MESH_FLAGS_AE_A5_A6 0x2 #define MESH_FLAGS_AE_A5_A6 0x2
@@ -269,4 +287,13 @@ ieee80211_mesh_hwmp_preq_get_bottom(const u8 *ie)
ieee80211_mesh_preq_prep_ae_enabled(ie) ? ETH_ALEN : 0]; ieee80211_mesh_preq_prep_ae_enabled(ie) ? ETH_ALEN : 0];
} }
static inline struct ieee80211_mesh_hwmp_prep_bottom *
ieee80211_mesh_hwmp_prep_get_bottom(const u8 *ie)
{
struct ieee80211_mesh_hwmp_prep_top *top = (void *)ie;
return (void *)&top->variable[
ieee80211_mesh_preq_prep_ae_enabled(ie) ? ETH_ALEN : 0];
}
#endif /* LINUX_IEEE80211_MESH_H */ #endif /* LINUX_IEEE80211_MESH_H */

46
net/mac80211/mesh_hwmp.c
View File

@@ -37,16 +37,6 @@ static inline u16 u16_field_get(const u8 *preq_elem, int offset, bool ae)
/* HWMP IE processing macros */ /* HWMP IE processing macros */
#define AE_F_SET(x) (*x & AE_F) #define AE_F_SET(x) (*x & AE_F)
#define PREP_IE_FLAGS(x) (*(x))
#define PREP_IE_HOPCOUNT(x) (*(x + 1))
#define PREP_IE_TTL(x) (*(x + 2))
#define PREP_IE_ORIG_ADDR(x) (AE_F_SET(x) ? x + 27 : x + 21)
#define PREP_IE_ORIG_SN(x) u32_field_get(x, 27, AE_F_SET(x))
#define PREP_IE_LIFETIME(x) u32_field_get(x, 13, AE_F_SET(x))
#define PREP_IE_METRIC(x) u32_field_get(x, 17, AE_F_SET(x))
#define PREP_IE_TARGET_ADDR(x) (x + 3)
#define PREP_IE_TARGET_SN(x) u32_field_get(x, 9, 0)
#define PERR_IE_TTL(x) (*(x)) #define PERR_IE_TTL(x) (*(x))
#define PERR_IE_TARGET_FLAGS(x) (*(x + 2)) #define PERR_IE_TARGET_FLAGS(x) (*(x + 2))
#define PERR_IE_TARGET_ADDR(x) (x + 3) #define PERR_IE_TARGET_ADDR(x) (x + 3)
@@ -419,11 +409,16 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
* so that we can easily use a single function to gather path * so that we can easily use a single function to gather path
* information from both PREQ and PREP frames. * information from both PREQ and PREP frames.
*/ */
orig_addr = PREP_IE_TARGET_ADDR(hwmp_ie); struct ieee80211_mesh_hwmp_prep_top *prep_elem_top =
orig_sn = PREP_IE_TARGET_SN(hwmp_ie); (void *)hwmp_ie;
orig_lifetime = PREP_IE_LIFETIME(hwmp_ie); struct ieee80211_mesh_hwmp_prep_bottom *prep_elem_bottom =
orig_metric = PREP_IE_METRIC(hwmp_ie); ieee80211_mesh_hwmp_prep_get_bottom(hwmp_ie);
hopcount = PREP_IE_HOPCOUNT(hwmp_ie) + 1;
orig_addr = prep_elem_top->target_addr;
orig_sn = le32_to_cpu(prep_elem_top->target_sn);
orig_lifetime = le32_to_cpu(prep_elem_bottom->lifetime);
orig_metric = le32_to_cpu(prep_elem_bottom->metric);
hopcount = prep_elem_top->hopcount + 1;
break; break;
default: default:
rcu_read_unlock(); rcu_read_unlock();
@@ -714,6 +709,9 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
const u8 *prep_elem, u32 metric) const u8 *prep_elem, u32 metric)
{ {
struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
struct ieee80211_mesh_hwmp_prep_top *prep_elem_top = (void *)prep_elem;
struct ieee80211_mesh_hwmp_prep_bottom *prep_elem_bottom =
ieee80211_mesh_hwmp_prep_get_bottom(prep_elem);
struct mesh_path *mpath; struct mesh_path *mpath;
const u8 *target_addr, *orig_addr; const u8 *target_addr, *orig_addr;
u8 ttl, hopcount, flags; u8 ttl, hopcount, flags;
@@ -721,9 +719,9 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
u32 target_sn, orig_sn, lifetime; u32 target_sn, orig_sn, lifetime;
mhwmp_dbg(sdata, "received PREP from %pM\n", mhwmp_dbg(sdata, "received PREP from %pM\n",
PREP_IE_TARGET_ADDR(prep_elem)); prep_elem_top->target_addr);
orig_addr = PREP_IE_ORIG_ADDR(prep_elem); orig_addr = prep_elem_bottom->orig_addr;
if (ether_addr_equal(orig_addr, sdata->vif.addr)) if (ether_addr_equal(orig_addr, sdata->vif.addr))
/* destination, no forwarding required */ /* destination, no forwarding required */
return; return;
@@ -731,7 +729,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
if (!ifmsh->mshcfg.dot11MeshForwarding) if (!ifmsh->mshcfg.dot11MeshForwarding)
return; return;
ttl = PREP_IE_TTL(prep_elem); ttl = prep_elem_top->ttl;
if (ttl <= 1) { if (ttl <= 1) {
sdata->u.mesh.mshstats.dropped_frames_ttl++; sdata->u.mesh.mshstats.dropped_frames_ttl++;
return; return;
@@ -750,12 +748,12 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
memcpy(next_hop, next_hop_deref_protected(mpath)->sta.addr, ETH_ALEN); memcpy(next_hop, next_hop_deref_protected(mpath)->sta.addr, ETH_ALEN);
spin_unlock_bh(&mpath->state_lock); spin_unlock_bh(&mpath->state_lock);
--ttl; --ttl;
flags = PREP_IE_FLAGS(prep_elem); flags = prep_elem_top->flags;
lifetime = PREP_IE_LIFETIME(prep_elem); lifetime = le32_to_cpu(prep_elem_bottom->lifetime);
hopcount = PREP_IE_HOPCOUNT(prep_elem) + 1; hopcount = prep_elem_top->hopcount + 1;
target_addr = PREP_IE_TARGET_ADDR(prep_elem); target_addr = prep_elem_top->target_addr;
target_sn = PREP_IE_TARGET_SN(prep_elem); target_sn = le32_to_cpu(prep_elem_top->target_sn);
orig_sn = PREP_IE_ORIG_SN(prep_elem); orig_sn = le32_to_cpu(prep_elem_bottom->orig_sn);
mesh_path_sel_frame_tx(MPATH_PREP, flags, orig_addr, orig_sn, 0, mesh_path_sel_frame_tx(MPATH_PREP, flags, orig_addr, orig_sn, 0,
target_addr, target_sn, next_hop, hopcount, target_addr, target_sn, next_hop, hopcount,