kernel/linux.git/net/mac80211/parse.c, branch v7.2-rc1

wifi: mac80211: always expose multi-link element

2026-06-03T12:11:57+00:00

During beacon processing, the parser is always called with a BSS to find the correct multi-BSSID profile (if any) and therefore never attempts to parse a multi-link element. This means the code to handle cross-link CSA can effectively never do anything. Fix this by parsing the multi-link element in the regular parser as well. Fixes: 7ef8f6821d16 ("wifi: mac80211: mlme: handle cross-link CSA") Reviewed-by: Miriam Rachel Korenblit Reviewed-by: Benjamin Berg Reviewed-by: Ilan Peer Link: https://patch.msgid.link/20260529102644.2a74b2659f50.I8f9454bf5e05c419a9b1eb23ecad302a6bf63fbb@changeid Signed-off-by: Johannes Berg

wifi: mac80211: use local ml_basic_elem in parsing

2026-06-03T12:11:57+00:00

There's no need to store this pointer on the heap, it's only used in a single function. Move it there. Also clarify the comment referencing it, ml_basic_elem is not actually relevant (any more.) Link: https://patch.msgid.link/20260529102644.50187b7a6ca2.Ifef23bda96651eed0f5cd2c3ecd4817d2fb08af4@changeid Signed-off-by: Johannes Berg

wifi: mac80211: clarify beacon parsing with MBSSID/EMA

2026-06-03T12:11:57+00:00

When connected to a non-transmitting BSS of multiple BSSID set with EMA, the correct profile for the connection isn't always present in the beacon. Indicate this in the parser and use the information to not check everything in beacon processing, since the information might not be correct if taken only from the transmitted BSS. Link: https://patch.msgid.link/20260529102644.97527a7dfd7b.Iecd0ef578b85a5a0057538cfff5fdff41d19b7ea@changeid Signed-off-by: Johannes Berg

wifi: mac80211: rename "multi_link_inner" variable

2026-06-03T12:11:57+00:00

This variable name seems a bit misleading now (I added it myself a year ago or so), it indicates that the parsing is happening on the inner elements of a multi-link element. Rename it to "inside_multilink" to clarify. Link: https://patch.msgid.link/20260529102644.7ccd55a411cf.I4101e1cfd133a2ce2374340712da8bb1f0292a40@changeid Signed-off-by: Johannes Berg

wifi: mac80211: clean up return in ieee802_11_find_bssid_profile()

2026-06-03T12:11:56+00:00

There's no need to define 'profile_len' at the outer scope and initialize it, move it where needed and just return 0 if nothing can be found. Link: https://patch.msgid.link/20260529102644.46f25609ddef.I9e651a0018e66953f4fb508f784188e00351c07f@changeid Signed-off-by: Johannes Berg

wifi: mac80211: Fix PERR frame processing

2026-06-03T12:07:07+00:00

There are no issues with the PERR processing itself; however, to maintain consistency with the previous PREQ/PREP code modifications, I will create a new mesh_path_parse_error_frame() function to separately implement the frame format validation and the "not supported" check. Signed-off-by: Masashi Honma Link: https://patch.msgid.link/20260529230952.124754-6-masashi.honma@gmail.com Signed-off-by: Johannes Berg

wifi: mac80211: Fix overread in PREP frame processing

2026-06-03T12:07:07+00:00

When the AF flag is enabled, hwmp_prep_frame_process() overreads orig_addr by 2 bytes. Since this occurs within the socket buffer, it does not read across memory boundaries and therefore poses no security risk; however, we will fix it as a precaution. In this fix, a new function mesh_path_parse_reply_frame() is established to separate the implementation of frame format validation and the check for unsupported features. This is intended to facilitate future work when implementing the currently unsupported parts. Assisted-by: Claude:Sonnet 4.6 Signed-off-by: Masashi Honma Link: https://patch.msgid.link/20260529230952.124754-5-masashi.honma@gmail.com Signed-off-by: Johannes Berg

wifi: mac80211: Fix overread in PREQ frame processing

2026-06-03T12:07:06+00:00

When the AF flag is enabled, hwmp_preq_frame_process() overreads target_addr by 2 bytes. Since this occurs within the socket buffer, it does not read across memory boundaries and therefore poses no security risk; however, we will fix it as a precaution. In this fix, a new function mesh_path_parse_request_frame() is established to separate the implementation of frame format validation and the check for unsupported features. This is intended to facilitate future work when implementing the currently unsupported parts. Assisted-by: Claude:Sonnet 4.6 Signed-off-by: Masashi Honma Link: https://patch.msgid.link/20260529230952.124754-4-masashi.honma@gmail.com Signed-off-by: Johannes Berg

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-05-21T22:09:02+00:00

Cross-merge networking fixes after downstream PR (net-7.1-rc5). No conflicts, adjacent changes: drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c cc199cd1b912 ("net/mlx5e: Reduce branches in napi poll") c326f9c68921 ("net/mlx5e: xsk: Fix unlocked writing to ICOSQ") drivers/net/ethernet/mellanox/mlx5/core/eswitch.c c6df9a65cbb0 ("net/mlx5: Skip disabled vports when setting max TX speed") 1fba57c91416 ("net/mlx5: Add VHCA_ID page management mode support") net/mac80211/mlme.c a6e6ccd5bd07 ("wifi: mac80211: consume only present negotiated TTLM maps") 49e62ec6eb06 ("wifi: mac80211: move frame RX handling to type files") Signed-off-by: Jakub Kicinski

wifi: mac80211: fix multi-link element inheritance

2026-05-20T09:19:53+00:00

When parsing a beacon, mac80211 erroneously inherits any reconfiguration or EPCS multi-link elements from the outer elements into the multi-BSSID profile that's requested, if connected to a non-transmitted BSS, unless that profile has a non-inheritance element. This also happens if parsing a multi-BSSID profile that doesn't have a non-inheritance element. Fix this by having an empty non-inheritance element so cfg80211_is_element_inherited() is invoked in these cases and causes the parser to skip the elements that should never be inherited. Fixes: cf36cdef10e2 ("wifi: mac80211: Add support for parsing Reconfiguration Multi Link element") Fixes: 24711d60f849 ("wifi: mac80211: Support parsing EPCS ML element") Reviewed-by: Ilan Peer Reviewed-by: Benjamin Berg Link: https://patch.msgid.link/20260508091032.92184c0a3f08.I3c43b0b63d2cef8a4ddddaef1c2faaeb1de711ad@changeid Signed-off-by: Johannes Berg