queue-6.6/wifi-iwlwifi-mvm-guard-against-invalid-sta-id-on-rem.patch

   1 From 92cc7bf110299bf8c1511ec62665e8a699525b71 Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Wed, 20 Mar 2024 23:26:23 +0200
   4 Subject: wifi: iwlwifi: mvm: guard against invalid STA ID on removal
   5
   6 From: Benjamin Berg <benjamin.berg@intel.com>
   7
   8 [ Upstream commit 17f64517bf5c26af56b6c3566273aad6646c3c4f ]
   9
  10 Guard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would
  11 result in out-of-bounds array accesses. This prevents issues should the
  12 driver get into a bad state during error handling.
  13
  14 Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
  15 Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
  16 Link: https://msgid.link/20240320232419.d523167bda9c.I1cffd86363805bf86a95d8bdfd4b438bb54baddc@changeid
  17 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  18 Signed-off-by: Sasha Levin <sashal@kernel.org>
  19 ---
  20  drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c | 7 ++++++-
  21  1 file changed, 6 insertions(+), 1 deletion(-)
  22
  23 diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c
  24 index 1ccbe8c1eeb42..278454c116fee 100644
  25 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c
  26 +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-sta.c
  27 @@ -853,10 +853,15 @@ int iwl_mvm_mld_rm_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
  28
  29  int iwl_mvm_mld_rm_sta_id(struct iwl_mvm *mvm, u8 sta_id)
  30  {
  31 -       int ret = iwl_mvm_mld_rm_sta_from_fw(mvm, sta_id);
  32 +       int ret;
  33
  34         lockdep_assert_held(&mvm->mutex);
  35
  36 +       if (WARN_ON(sta_id == IWL_MVM_INVALID_STA))
  37 +               return 0;
  38 +
  39 +       ret = iwl_mvm_mld_rm_sta_from_fw(mvm, sta_id);
  40 +
  41         RCU_INIT_POINTER(mvm->fw_id_to_mac_id[sta_id], NULL);
  42         RCU_INIT_POINTER(mvm->fw_id_to_link_sta[sta_id], NULL);
  43         return ret;
  44 --
  45 2.43.0
  46