From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f178.google.com (mail-qk1-f178.google.com [209.85.222.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 824602DB78C for ; Sat, 11 Jul 2026 15:06:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783782377; cv=none; b=PAHrq5VD9z4Ab9qAiQRt1Mvuw23obw0oO2EkUjT86rPZhsod6Nl6jGtJUkQeEgPqIYKngER07dI/K1YeVIXMZsPj7Pc47UdMfVJt6/gVVD/xN4E6S3ymt4nm+WvmZJCB/4kBNSAfUJCkW4I7Yt3r6/FIvvzzReBtT6HGxGwmYpg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783782377; c=relaxed/simple; bh=8UpyJxckMHUMLlbtyRgGGg26hezMZtk8A8xmtE1pZOA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pGaMLZAc+8F17zRRtThqINLrMn81036P4Ewtir2pF6AjyAoHIzvRs3ROop5MGzQHAv/oHOXnvojdJuWB4qvTORrcz87T4rz7E+yjNp+7tpEcTsJRYZB7d1mufwYfrc5tr0TZPY9Z1th/aRYNEsRVZD33zs7gx9YmB+MSWjUnVIU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=fCoUiTr8; arc=none smtp.client-ip=209.85.222.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="fCoUiTr8" Received: by mail-qk1-f178.google.com with SMTP id af79cd13be357-92e4fd65b2bso91596685a.0 for ; Sat, 11 Jul 2026 08:06:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783782374; x=1784387174; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=qPPgg5HFLluz6FRieBbyWJGx0FqM2rMhvYorHbuk6xc=; b=fCoUiTr86kQgSOzvsiKKYan57Tzz96PAu1bQQFWsiLD42jy+sf5z5Q3L2+J0aeiwdn spHXZekJZSooLr+afeoljgnaca6KOzJErLXDNK7YtgLE3ncbupR3DZ8bbroJkBypCdXZ 0oLIP3r9DOQeG5iFU//9EzXaLMGu7HFWkZnUbgNLz4/IexjiW02dCmnnU2uetLZYLgr9 pvg4SsibPrwnEN2nVdJLm6NA8TOW7zF21ZTiTcPpZJY20UZjvbzD9UPLZpXVPg4MLTWY CpWAvIbC7ePdk/a/7qfcpiRLro7sdW4bit3PAIiFdERbH4ZbpmFN5KSxrt0uCoiRWdUT /y7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783782374; x=1784387174; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=qPPgg5HFLluz6FRieBbyWJGx0FqM2rMhvYorHbuk6xc=; b=iKV8zgGz/TsOigKrYvRr/P9D0eE31zalg5QFLMzXNMlMkdfhgoetq1MDxpN1D/rBKA j0eDcydg3z+IQnAzJcTPUc89V69tDNJl/u11q7r3+U1M2C0cd7c9AhFnmuWXdl67eIjL IE1o6WUsnaUSYzWkLdD52TowOarSYRSYBeeI0SVh1UEh8tLHklj36g8UKEeNRPd4EV89 DCBqalSz1N1vFHpLFQF3dn0eHGUYUDJ0bLKhIoiVdL8pfbzZHto/eNT2xd7qBRGRQ1IE At8Ixp3fzzfignU5GWy1//55V9mUGDEPjY92lMy0vtfstwMB1eQ6xG5u7eUkQgc5XhzR NwXg== X-Forwarded-Encrypted: i=1; AHgh+RqXYvKk/KNKTYj5n/40OWT3vwirkHCSIqrRwkenZWaiokQj7mFbQliOq0X7FYDxApr8PggkHiFllCsHUIE=@vger.kernel.org X-Gm-Message-State: AOJu0Yz8clf/sz5xSFQpcVzLaw0B4hupto4jJ+hlhuPEtRTScwzvr0I9 +EJIFmoBVC2DH6tN9cLrShJSO5EYS05RWght/ziGRqE28FfVmekAvRfj X-Gm-Gg: AfdE7clM0vNgZnIRnT0PmEvhpIp3ojlv9fWCJhQiRePeBjKCCzTuoURF+IApelNf2r3 80DQems4uDo51JosZ3MZZffovHUj2TmNAhJS14OxZj1SqygOgIvRKnfAxSn/Td6VG0UijqRDKmj 8IMoXT0liiDrFKZ3Ee7lTP094jmnIiwr2+Tkv2e/LXOmjIFbnaMiYHKdvMfxKJJxgpi5G700Lwt ss4Z9whaacGh0bZokqQ1t0yv+yVdpFrDViNS60Q0txIagQFf3/TcvK5NV6nQme/enN/0GNkDpmp Xzsa341A+HjMUEE0acB50Vc2sr8Xjg7mKuBTR7IhE+Syx1cuol9vDDshn8/NFOx7YH2WrquIGWc Moyj1BcSbDIBRHVsF2HN/UDKmFahdhP3m9mjIwpM2aRlOAKJamPn2AwNuS/ss2Ev7p7ujKlsIAB lTrNOqGPKEDVdmpGiHpgBcRKUm6H8EcY8DbLUir+7Rxp6NZCv+4/g9nC74wDACMpA4eqRvMAoeV MKliaPXAw== X-Received: by 2002:a05:620a:298b:b0:92e:72a4:f282 with SMTP id af79cd13be357-92ef2c1fc21mr314510985a.46.1783782374433; Sat, 11 Jul 2026 08:06:14 -0700 (PDT) Received: from server0 (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id af79cd13be357-92ee5d68e5fsm464578285a.43.2026.07.11.08.06.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 11 Jul 2026 08:06:13 -0700 (PDT) From: Michael Bommarito To: Miri Korenblit , Johannes Berg Cc: Emmanuel Grumbach , Benjamin Berg , linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH 1/2] wifi: iwlwifi: mvm: check BA-window station ID before lookup Date: Sat, 11 Jul 2026 11:06:10 -0400 Message-ID: <20260711150611.2913332-2-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260711150611.2913332-1-michael.bommarito@gmail.com> References: <20260711150611.2913332-1-michael.bommarito@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit iwl_mvm_window_status_notif() extracts a station ID from the BA-window status notification's ra_tid field. The firmware API allocates five bits for that field, so it can encode values up to 31. The station map is bounded by the firmware's station capacity and physically sized to IWL_STATION_COUNT_MAX entries. Validate the extracted station ID before indexing fw_id_to_mac_id[]. This matches the existing MVM station lookup helpers, which reject IDs outside mvm->fw->ucode_capa.num_stations before reading the station map. Fixes: 3af512d6aac7 ("iwlwifi: mvm: support filtered frames notification") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito --- drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c index 269c4b45de807..d373f0723e13d 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c @@ -7,6 +7,7 @@ #include #include #include +#include "iwl-drv.h" #include "iwl-trans.h" #include "mvm.h" #include "fw-api.h" @@ -1227,6 +1228,8 @@ void iwl_mvm_window_status_notif(struct iwl_mvm *mvm, /* get the station */ sta_id = (ratid & BA_WINDOW_STATUS_STA_ID_MSK) >> BA_WINDOW_STATUS_STA_ID_POS; + if (sta_id >= mvm->fw->ucode_capa.num_stations) + continue; sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]); if (IS_ERR_OR_NULL(sta)) continue; @@ -1239,3 +1242,4 @@ void iwl_mvm_window_status_notif(struct iwl_mvm *mvm, } rcu_read_unlock(); } +EXPORT_SYMBOL_IF_IWLWIFI_KUNIT(iwl_mvm_window_status_notif); -- 2.53.0