Commit 19aa842d authored by Ilan Peer's avatar Ilan Peer Committed by Johannes Berg
Browse files

wifi: mac80211: Fix common size calculation for ML element 



When the ML type is EPCS the control bitmap is reserved, the length
is always 7 and is captured by the 1st octet after the control.

Fixes: 0f48b8b8 ("wifi: ieee80211: add definitions for multi-link element")
Signed-off-by: default avatarIlan Peer <ilan.peer@intel.com>
Reviewed-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarMiri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20250102161730.5790376754a7.I381208cbb72b1be2a88239509294099e9337e254@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 904c2773

include/linux/ieee80211.h

+3 −8
Original line number Diff line number Diff line
@@ -5084,28 +5084,24 @@ static inline u8 ieee80211_mle_common_size(const u8 *data) 
{

	const struct ieee80211_multi_link_elem *mle = (const void *)data;

	u16 control = le16_to_cpu(mle->control);

	u8 common = 0;



	switch (u16_get_bits(control, IEEE80211_ML_CONTROL_TYPE)) {

	case IEEE80211_ML_CONTROL_TYPE_BASIC:

	case IEEE80211_ML_CONTROL_TYPE_PREQ:

	case IEEE80211_ML_CONTROL_TYPE_TDLS:

	case IEEE80211_ML_CONTROL_TYPE_RECONF:

	case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:

		/*

		 * The length is the first octet pointed by mle->variable so no

		 * need to add anything

		 */

		break;

	case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:

		if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR)

			common += ETH_ALEN;

		return common;

	default:

		WARN_ON(1);

		return 0;

	}



	return sizeof(*mle) + common + mle->variable[0];

	return sizeof(*mle) + mle->variable[0];

}



/**
@@ -5392,8 +5388,7 @@ static inline bool ieee80211_mle_size_ok(const u8 *data, size_t len) 
		check_common_len = true;

		break;

	case IEEE80211_ML_CONTROL_TYPE_PRIO_ACCESS:

		if (control & IEEE80211_MLC_PRIO_ACCESS_PRES_AP_MLD_MAC_ADDR)

			common += ETH_ALEN;

		common = ETH_ALEN + 1;

		break;

	default:

		/* we don't know this type */