diff options
| author | Emmanuel Grumbach <emmanuel.grumbach@intel.com> | 2026-07-14 14:19:55 +0300 |
|---|---|---|
| committer | Miri Korenblit <miriam.rachel.korenblit@intel.com> | 2026-07-14 20:45:20 +0300 |
| commit | 219292e73e40d131925a1caf413203671092dd7a (patch) | |
| tree | 5a3bc51e79b042ecbd753f5f422414739880ab9f /drivers/net/wireless | |
| parent | 7da7162652a9e254f2c6055cb8612bbe8a49a554 (diff) | |
| download | linux-next-219292e73e40d131925a1caf413203671092dd7a.tar.gz linux-next-219292e73e40d131925a1caf413203671092dd7a.zip | |
wifi: iwlwifi: mld: validate reorder BAID
Reject BAIDs >= IWL_MAX_BAID before indexing fw_id_to_ba.
This prevents out-of-bounds access on malformed notifications.
Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714141909.07ea823b8eea.Ica915fa0cce0427bf5e3420ae933f57118fedf86@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mld/agg.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/agg.c b/drivers/net/wireless/intel/iwlwifi/mld/agg.c index e3627ad0321c..a464ebdec57f 100644 --- a/drivers/net/wireless/intel/iwlwifi/mld/agg.c +++ b/drivers/net/wireless/intel/iwlwifi/mld/agg.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* - * Copyright (C) 2024-2025 Intel Corporation + * Copyright (C) 2024-2026 Intel Corporation */ #include "agg.h" #include "sta.h" @@ -222,6 +222,11 @@ iwl_mld_reorder(struct iwl_mld *mld, struct napi_struct *napi, if (baid == IWL_RX_REORDER_DATA_INVALID_BAID) return IWL_MLD_PASS_SKB; + if (IWL_FW_CHECK(mld, baid >= ARRAY_SIZE(mld->fw_id_to_ba), + "Got out-of-range BAID %u in reorder_data=0x%x\n", + baid, reorder)) + return IWL_MLD_PASS_SKB; + /* no sta yet */ if (WARN_ONCE(!sta, "Got valid BAID without a valid station assigned\n")) |