wifi: mac80211: Use struct instead of macro for PREQ frame

The existing PREQ_IE_* macros access HWMP PREQ frame fields via hardcoded
byte offsets. When the AE (Address Extension) flag is set, an additional
6 bytes appear mid-frame, and the macros handle this with conditional
arithmetic (e.g., AE_F_SET(x) ? x + N+6 : x + N). This approach
obscures the frame layout and is prone to miscalculation.

Introduce typed packed C structs to represent the PREQ frame layout:
  - ieee80211_mesh_hwmp_preq_top: fixed fields before the optional AE
    address
  - ieee80211_mesh_hwmp_preq_bottom: fields after the optional AE address
  - ieee80211_mesh_hwmp_preq_target: per-target fields

Add ieee80211_mesh_hwmp_preq_get_bottom() to locate the bottom struct
correctly based on whether the AE flag is set.

This preparatory refactoring is needed to fix a 2-byte overread of
target_addr in hwmp_preq_frame_process() when AE is enabled, which is
addressed in a subsequent patch.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
Link: https://patch.msgid.link/20260529230952.124754-1-masashi.honma@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/include/linux/ieee80211-mesh.h b/include/linux/ieee80211-mesh.h
index 4b829bcb38b61b6853cbe75f083014eb98d37ae8..bf4a544aed00572d4215e8f131c5b38c2b1cc25a 100644 (file)
--- a/include/linux/ieee80211-mesh.h
+++ b/include/linux/ieee80211-mesh.h
@@ -28,12 +28,40 @@ struct ieee80211s_hdr {
        u8 eaddr2[ETH_ALEN];
 } __packed __aligned(2);
 
+struct ieee80211_mesh_hwmp_preq_target {
+       u8 flags;
+       u8 addr[ETH_ALEN];
+       __le32 sn;
+} __packed;
+
+struct ieee80211_mesh_hwmp_preq_top {
+       u8 flags;
+       u8 hopcount;
+       u8 ttl;
+       __le32 preq_id;
+       u8 orig_addr[ETH_ALEN];
+       __le32 orig_sn;
+
+       /* optional AE, lifetime, metric, target */
+       u8 variable[];
+} __packed;
+
+struct ieee80211_mesh_hwmp_preq_bottom {
+       __le32 lifetime;
+       __le32 metric;
+       u8 target_count;
+       struct ieee80211_mesh_hwmp_preq_target targets[];
+} __packed;
+
 /* Mesh flags */
 #define MESH_FLAGS_AE_A4       0x1
 #define MESH_FLAGS_AE_A5_A6    0x2
 #define MESH_FLAGS_AE          0x3
 #define MESH_FLAGS_PS_DEEP     0x4
 
+/* HWMP IE processing macros */
+#define AE_F                   (1<<6)
+
 /**
  * enum ieee80211_preq_flags - mesh PREQ element flags
  *
@@ -227,4 +255,18 @@ enum ieee80211_root_mode_identifier {
        IEEE80211_PROACTIVE_RANN = 4,
 };
 
+static inline bool ieee80211_mesh_preq_prep_ae_enabled(const u8 *ie)
+{
+       return ie[0] & AE_F;
+}
+
+static inline struct ieee80211_mesh_hwmp_preq_bottom *
+ieee80211_mesh_hwmp_preq_get_bottom(const u8 *ie)
+{
+       struct ieee80211_mesh_hwmp_preq_top *top = (void *)ie;
+
+       return (void *)&top->variable[
+               ieee80211_mesh_preq_prep_ae_enabled(ie) ? ETH_ALEN : 0];
+}
+
 #endif /* LINUX_IEEE80211_MESH_H */

diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 9d89ebcce1c14b284744eaf0ffbc92ce09d1231b..1a6a22b185d9fe4a7a4126ebc1303729c5b892b2 100644 (file)
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -35,24 +35,11 @@ static inline u16 u16_field_get(const u8 *preq_elem, int offset, bool ae)
 }
 
 /* HWMP IE processing macros */
-#define AE_F                   (1<<6)
 #define AE_F_SET(x)            (*x & AE_F)
-#define PREQ_IE_FLAGS(x)       (*(x))
-#define PREQ_IE_HOPCOUNT(x)    (*(x + 1))
-#define PREQ_IE_TTL(x)         (*(x + 2))
-#define PREQ_IE_PREQ_ID(x)     u32_field_get(x, 3, 0)
-#define PREQ_IE_ORIG_ADDR(x)   (x + 7)
-#define PREQ_IE_ORIG_SN(x)     u32_field_get(x, 13, 0)
-#define PREQ_IE_LIFETIME(x)    u32_field_get(x, 17, AE_F_SET(x))
-#define PREQ_IE_METRIC(x)      u32_field_get(x, 21, AE_F_SET(x))
-#define PREQ_IE_TARGET_F(x)    (*(AE_F_SET(x) ? x + 32 : x + 26))
-#define PREQ_IE_TARGET_ADDR(x)         (AE_F_SET(x) ? x + 33 : x + 27)
-#define PREQ_IE_TARGET_SN(x)   u32_field_get(x, 33, AE_F_SET(x))
-
-
-#define PREP_IE_FLAGS(x)       PREQ_IE_FLAGS(x)
-#define PREP_IE_HOPCOUNT(x)    PREQ_IE_HOPCOUNT(x)
-#define PREP_IE_TTL(x)         PREQ_IE_TTL(x)
+
+#define PREP_IE_FLAGS(x)       (*(x))
+#define PREP_IE_HOPCOUNT(x)    (*(x + 1))
+#define PREP_IE_TTL(x)         (*(x + 2))
 #define PREP_IE_ORIG_ADDR(x)   (AE_F_SET(x) ? x + 27 : x + 21)
 #define PREP_IE_ORIG_SN(x)     u32_field_get(x, 27, AE_F_SET(x))
 #define PREP_IE_LIFETIME(x)    u32_field_get(x, 13, AE_F_SET(x))
@@ -415,11 +402,16 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
        switch (action) {
        case MPATH_PREQ:
-               orig_addr = PREQ_IE_ORIG_ADDR(hwmp_ie);
-               orig_sn = PREQ_IE_ORIG_SN(hwmp_ie);
-               orig_lifetime = PREQ_IE_LIFETIME(hwmp_ie);
-               orig_metric = PREQ_IE_METRIC(hwmp_ie);
-               hopcount = PREQ_IE_HOPCOUNT(hwmp_ie) + 1;
+               struct ieee80211_mesh_hwmp_preq_top *preq_elem_top =
+                       (void *)hwmp_ie;
+               struct ieee80211_mesh_hwmp_preq_bottom *preq_elem_bottom =
+                       ieee80211_mesh_hwmp_preq_get_bottom(hwmp_ie);
+
+               orig_addr = preq_elem_top->orig_addr;
+               orig_sn = le32_to_cpu(preq_elem_top->orig_sn);
+               orig_lifetime = le32_to_cpu(preq_elem_bottom->lifetime);
+               orig_metric = le32_to_cpu(preq_elem_bottom->metric);
+               hopcount = preq_elem_top->hopcount + 1;
                break;
        case MPATH_PREP:
                /* Originator here refers to the MP that was the target in the
@@ -579,6 +571,11 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                                    const u8 *preq_elem, u32 orig_metric)
 {
        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+       struct ieee80211_mesh_hwmp_preq_top *preq_elem_top = (void *)preq_elem;
+       struct ieee80211_mesh_hwmp_preq_bottom *preq_elem_bottom =
+               ieee80211_mesh_hwmp_preq_get_bottom(preq_elem);
+       struct ieee80211_mesh_hwmp_preq_target *target =
+               preq_elem_bottom->targets;
        struct mesh_path *mpath = NULL;
        const u8 *target_addr, *orig_addr;
        const u8 *da;
@@ -589,13 +586,13 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
        bool root_is_gate;
 
        /* Update target SN, if present */
-       target_addr = PREQ_IE_TARGET_ADDR(preq_elem);
-       orig_addr = PREQ_IE_ORIG_ADDR(preq_elem);
-       target_sn = PREQ_IE_TARGET_SN(preq_elem);
-       orig_sn = PREQ_IE_ORIG_SN(preq_elem);
-       target_flags = PREQ_IE_TARGET_F(preq_elem);
+       target_addr = target[0].addr;
+       orig_addr = preq_elem_top->orig_addr;
+       target_sn = le32_to_cpu(target[0].sn);
+       orig_sn = le32_to_cpu(preq_elem_top->orig_sn);
+       target_flags = target[0].flags;
        /* Proactive PREQ gate announcements */
-       flags = PREQ_IE_FLAGS(preq_elem);
+       flags = preq_elem_top->flags;
        root_is_gate = !!(flags & RANN_FLAG_IS_GATE);
 
        mhwmp_dbg(sdata, "received PREQ from %pM\n", orig_addr);
@@ -655,7 +652,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
        }
 
        if (reply) {
-               lifetime = PREQ_IE_LIFETIME(preq_elem);
+               lifetime = le32_to_cpu(preq_elem_bottom->lifetime);
                ttl = ifmsh->mshcfg.element_ttl;
                if (ttl != 0) {
                        mhwmp_dbg(sdata, "replying to the PREQ\n");
@@ -673,22 +670,22 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                u32 preq_id;
                u8 hopcount;
 
-               ttl = PREQ_IE_TTL(preq_elem);
-               lifetime = PREQ_IE_LIFETIME(preq_elem);
+               ttl = preq_elem_top->ttl;
+               lifetime = le32_to_cpu(preq_elem_bottom->lifetime);
                if (ttl <= 1) {
                        ifmsh->mshstats.dropped_frames_ttl++;
                        return;
                }
                mhwmp_dbg(sdata, "forwarding the PREQ from %pM\n", orig_addr);
                --ttl;
-               preq_id = PREQ_IE_PREQ_ID(preq_elem);
-               hopcount = PREQ_IE_HOPCOUNT(preq_elem) + 1;
+               preq_id = le32_to_cpu(preq_elem_top->preq_id);
+               hopcount = preq_elem_top->hopcount + 1;
                da = (mpath && mpath->is_root) ?
                        mpath->rann_snd_addr : broadcast_addr;
 
                if (flags & IEEE80211_PREQ_PROACTIVE_PREP_FLAG) {
-                       target_addr = PREQ_IE_TARGET_ADDR(preq_elem);
-                       target_sn = PREQ_IE_TARGET_SN(preq_elem);
+                       target_addr = target[0].addr;
+                       target_sn = le32_to_cpu(target[0].sn);
                }
 
                mesh_path_sel_frame_tx(MPATH_PREQ, flags, orig_addr,