[PATCH 0/2] wifi: iwlwifi: mvm: bound BA-window station ID

[PATCH 0/2] wifi: iwlwifi: mvm: bound BA-window station ID

[Michael Bommarito]

iwl_mvm_window_status_notif() extracts a 5-bit station ID from the
firmware's BA-window status notification (values up to 31) and indexes
mvm->fw_id_to_mac_id[] with it without first checking it against the
firmware's station capacity. A firmware/backend notification carrying an
out-of-range ID reads past the station map.

Patch 1 validates the station ID against mvm->fw->ucode_capa.num_stations
before the lookup, matching the existing MVM station-lookup helpers. Patch
2 adds KUnit coverage: the malformed out-of-range ID and a valid-ID/
null-station control that must still pass.

Reproduced with the KUnit test under UBSAN bounds: the malformed case
reports an array-index-out-of-bounds splat on stock and passes after the
fix; the valid-ID control passes on both.

Cc: stable@vger.kernel.org

Michael Bommarito (2):
  wifi: iwlwifi: mvm: check BA-window station ID before lookup
  wifi: iwlwifi: mvm: add KUnit coverage for BA-window station ID bounds

 drivers/net/wireless/intel/iwlwifi/mvm/rx.c   |  4 +
 .../wireless/intel/iwlwifi/mvm/tests/Makefile |  2 +-
 .../intel/iwlwifi/mvm/tests/window-status.c   | 77 +++++++++++++++++++
 3 files changed, 82 insertions(+), 1 deletion(-)
 create mode 100644 drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c

--
2.53.0

[PATCH 1/2] wifi: iwlwifi: mvm: check BA-window station ID before lookup

[Michael Bommarito]

iwl_mvm_window_status_notif() extracts a station ID from the BA-window
status notification's ra_tid field. The firmware API allocates five bits
for that field, so it can encode values up to 31.

The station map is bounded by the firmware's station capacity and
physically sized to IWL_STATION_COUNT_MAX entries. Validate the extracted
station ID before indexing fw_id_to_mac_id[]. This matches the existing
MVM station lookup helpers, which reject IDs outside
mvm->fw->ucode_capa.num_stations before reading the station map.

Fixes: 3af512d6aac7 ("iwlwifi: mvm: support filtered frames notification")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
---
 drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 269c4b45de807..d373f0723e13d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -7,6 +7,7 @@
 #include <linux/unaligned.h>
 #include <linux/etherdevice.h>
 #include <linux/skbuff.h>
+#include "iwl-drv.h"
 #include "iwl-trans.h"
 #include "mvm.h"
 #include "fw-api.h"
@@ -1227,6 +1228,8 @@ void iwl_mvm_window_status_notif(struct iwl_mvm *mvm,
 		/* get the station */
 		sta_id = (ratid & BA_WINDOW_STATUS_STA_ID_MSK)
 			 >> BA_WINDOW_STATUS_STA_ID_POS;
+		if (sta_id >= mvm->fw->ucode_capa.num_stations)
+			continue;
 		sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
 		if (IS_ERR_OR_NULL(sta))
 			continue;
@@ -1239,3 +1242,4 @@ void iwl_mvm_window_status_notif(struct iwl_mvm *mvm,
 	}
 	rcu_read_unlock();
 }
+EXPORT_SYMBOL_IF_IWLWIFI_KUNIT(iwl_mvm_window_status_notif);
-- 
2.53.0

[PATCH 2/2] wifi: iwlwifi: mvm: add KUnit coverage for BA-window station ID bounds

[Michael Bommarito]

Add KUnit coverage for a malformed BA-window notification carrying an
out-of-range station ID, plus a valid-ID/null-station path to exercise the
adjacent non-bug branch. With UBSAN bounds enabled, the malformed case
reports an array-index-out-of-bounds splat before the fix and passes after
it.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
---
 .../wireless/intel/iwlwifi/mvm/tests/Makefile |  2 +-
 .../intel/iwlwifi/mvm/tests/window-status.c   | 77 +++++++++++++++++++
 2 files changed, 78 insertions(+), 1 deletion(-)
 create mode 100644 drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tests/Makefile b/drivers/net/wireless/intel/iwlwifi/mvm/tests/Makefile
index 2267be4cfb441..bf22750fceafc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tests/Makefile
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tests/Makefile
@@ -1,3 +1,3 @@
-iwlmvm-tests-y += module.o hcmd.o
+iwlmvm-tests-y += module.o hcmd.o window-status.o
 
 obj-$(CONFIG_IWLWIFI_KUNIT_TESTS) += iwlmvm-tests.o
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c b/drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c
new file mode 100644
index 0000000000000..06807e2bdbc12
--- /dev/null
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c
@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
+/*
+ * KUnit tests for MVM BA window status notification handling
+ */
+#include <kunit/test.h>
+#include <linux/mm.h>
+
+#include <iwl-trans.h>
+#include "../fw-api.h"
+#include "../mvm.h"
+
+MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING");
+
+static void iwl_mvm_test_window_status(struct kunit *test, u8 sta_id)
+{
+	struct iwl_ba_window_status_notif notif = {};
+	struct iwl_rx_cmd_buffer rxb = {
+		._offset = 0,
+		._rx_page_order = 0,
+	};
+	struct iwl_rx_packet *pkt;
+	struct iwl_fw *fw;
+	struct iwl_mvm *mvm;
+	u16 ratid;
+
+	BUILD_BUG_ON((IWL_STATION_COUNT_MAX + 1) >
+		     (BA_WINDOW_STATUS_STA_ID_MSK >>
+		      BA_WINDOW_STATUS_STA_ID_POS));
+
+	mvm = kunit_kzalloc(test, sizeof(*mvm), GFP_KERNEL);
+	KUNIT_ASSERT_NOT_NULL(test, mvm);
+
+	fw = kunit_kzalloc(test, sizeof(*fw), GFP_KERNEL);
+	KUNIT_ASSERT_NOT_NULL(test, fw);
+	fw->ucode_capa.num_stations = IWL_STATION_COUNT_MAX;
+	mvm->fw = fw;
+
+	rxb._page = alloc_page(GFP_KERNEL);
+	KUNIT_ASSERT_NOT_NULL(test, rxb._page);
+
+	ratid = BA_WINDOW_STATUS_VALID_MSK |
+		(sta_id << BA_WINDOW_STATUS_STA_ID_POS);
+	notif.ra_tid[0] = cpu_to_le16(ratid);
+	notif.mpdu_rx_count[0] = cpu_to_le16(1);
+
+	pkt = rxb_addr(&rxb);
+	memset(pkt, 0, PAGE_SIZE);
+	pkt->len_n_flags = cpu_to_le32(sizeof(pkt->hdr) + sizeof(notif));
+	memcpy(pkt->data, &notif, sizeof(notif));
+
+	iwl_mvm_window_status_notif(mvm, &rxb);
+
+	__free_page(rxb._page);
+}
+
+static void test_ba_window_status_station_id_bounds(struct kunit *test)
+{
+	iwl_mvm_test_window_status(test, IWL_STATION_COUNT_MAX + 1);
+}
+
+static void test_ba_window_status_valid_empty_station(struct kunit *test)
+{
+	iwl_mvm_test_window_status(test, 0);
+}
+
+static struct kunit_case window_status_cases[] = {
+	KUNIT_CASE(test_ba_window_status_station_id_bounds),
+	KUNIT_CASE(test_ba_window_status_valid_empty_station),
+	{},
+};
+
+static struct kunit_suite window_status = {
+	.name = "iwlmvm-window-status",
+	.test_cases = window_status_cases,
+};
+
+kunit_test_suite(window_status);
-- 
2.53.0